Skip to content
OpenAdvisories

Package · npm

webpack-dev-server

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-14631

    webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

    webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. T…

    webpack-dev-server webpack-dev-server webpack-dev-server npm
  • Medium 4.7
    CVE-2026-14620 Public exploit

    webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

    webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated fro…

    webpack-dev-server webpack-dev-server webpack-dev-server npm
  • Medium 5.3
    CVE-2026-9595

    webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

    Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend,…

    webpack-dev-server webpack-dev-server webpack-dev-server node-webpack Ubuntu npm
  • Medium 5.3
    CVE-2026-6402

    webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

    webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request heade…

    webpack-dev-server webpack-dev-server webpack-dev-server npm
  • Medium 6.5
    CVE-2025-30360

    webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

    webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origi…

    webpack webpack-dev-server webpack-dev-server npm
  • Medium 5.3
    CVE-2025-30359

    webpack-dev-server users' source code may be stolen when they access a malicious web site

    webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by…

    webpack webpack-dev-server webpack-dev-server npm