CVE-2026-14631
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in webpack-dev-server versions 5.2.5 and earlier crashes the entire Node.js process when an unauthenticated peer sends a malformed Host header in an HTTP request or a malformed Origin header in a WebSocket upgrade. The malformed value triggers an uncaught exception in the host-validation path, crashing the dev server.
Risk Assessment
The risk is limited to availability of the development server, potentially disrupting developer workflows and CI/CD pipelines. No data disclosure or code execution is possible.
Recommendation
Upgrade to webpack-dev-server 5.2.6 immediately. If upgrading is not possible, keep the dev server bound to localhost (default) and do not expose it to untrusted networks.
Other vulnerabilities in webpack-dev-server
See all- CVE-2026-14620Medium
A vulnerability in webpack-dev-server versions 5.2.5 and earlier allows an attacker to perform unauthorized actions on the dev server by sending GET requests to internal endpoints. The attack requires no user interaction beyond the developer visiting a malicious website while the dev server is running.
- CVE-2026-9595Medium
A vulnerability in webpack-dev-server allows for the interception of browser cookies and the Origin header when a user-configured proxy has a broad context and ws: true enabled. This leads to bypassing Host/Origin validation and corrupting the HMR socket.
Original NVD description (English source)
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.