webpack-dev-server vulnerabilities

A vulnerability in webpack-dev-server versions 5.2.5 and earlier crashes the entire Node.js process when an unauthenticated peer sends a malformed Host header in an HTTP request or a malformed Origin header in a WebSocket upgrade. The malformed value triggers an uncaught exception in the host-validation path, crashing the dev server.

A vulnerability in webpack-dev-server versions 5.2.5 and earlier allows an attacker to perform unauthorized actions on the dev server by sending GET requests to internal endpoints. The attack requires no user interaction beyond the developer visiting a malicious website while the dev server is running.

A vulnerability in webpack-dev-server allows for the interception of browser cookies and the Origin header when a user-configured proxy has a broad context and ws: true enabled. This leads to bypassing Host/Origin validation and corrupting the HMR socket.