CVE-2026-114348
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
webpack-dev-server versions 5.1.0 before 5.2.7 and version 6.0.0 have an unauthenticated open-editor endpoint that validates the Host header with a regular expression meant for browser Origin schemes. A Host value beginning with file: or an extension scheme bypasses hostname and allowedHosts checks, and URL construction throws. In default non-production mode the server returns HTTP 500 with a full stack trace, disclosing filesystem paths, module locations, and source line numbers.
Risk Assessment
An attacker with network access to the dev server can obtain information about the filesystem structure and internal source code. This aids further attacks and environment reconnaissance.
Recommendation
Upgrade webpack-dev-server to version 5.2.7, 6.1.0, or later. Do not expose the dev server on untrusted networks.
Other vulnerabilities in webpack-dev-server
See all- CVE-2026-112085High
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback.
- CVE-2026-14631Medium
A vulnerability in webpack-dev-server versions 5.2.5 and earlier crashes the entire Node.js process when an unauthenticated peer sends a malformed Host header in an HTTP request or a malformed Origin header in a WebSocket upgrade. The malformed value triggers an uncaught exception in the host-validation path, crashing the dev server.
- CVE-2026-14620Medium
A vulnerability in webpack-dev-server versions 5.2.5 and earlier allows an attacker to perform unauthorized actions on the dev server by sending GET requests to internal endpoints. The attack requires no user interaction beyond the developer visiting a malicious website while the dev server is running.
- CVE-2026-9595Medium
A vulnerability in webpack-dev-server allows for the interception of browser cookies and the Origin header when a user-configured proxy has a broad context and ws: true enabled. This leads to bypassing Host/Origin validation and corrupting the HMR socket.
Original NVD description (English source)
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value beginning with file: or with an extension scheme short-circuits the hostname and allowedHosts checks. A network peer that can reach the dev server can send a request with a malformed Host that passes validation and then causes the endpoint's URL construction to throw, and in the default non-production mode the server returns an HTTP 500 body containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers. The server keeps running, so there is no denial of service. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, and users should upgrade to one of those versions or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS