CVE-2026-14620
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in webpack-dev-server versions 5.2.5 and earlier allows an attacker to perform unauthorized actions on the dev server by sending GET requests to internal endpoints. The attack requires no user interaction beyond the developer visiting a malicious website while the dev server is running.
Risk Assessment
The risk includes the ability to open arbitrary local files in the developer's editor, including files outside the project root, and to overload the developer's machine by spawning editor processes and forcing recompilations, potentially leading to performance degradation and sensitive data exposure.
Recommendation
Upgrade webpack-dev-server to version 5.2.6 or later immediately. No workarounds are available.
Other vulnerabilities in webpack-dev-server
See all- CVE-2026-114348Medium
webpack-dev-server versions 5.1.0 before 5.2.7 and version 6.0.0 have an unauthenticated open-editor endpoint that validates the Host header with a regular expression meant for browser Origin schemes. A Host value beginning with file: or an extension scheme bypasses hostname and allowedHosts checks, and URL construction throws. In default non-production mode the server returns HTTP 500 with a full stack trace, disclosing filesystem paths, module locations, and source line numbers.
- CVE-2026-112085High
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback.
- CVE-2026-14631Medium
A vulnerability in webpack-dev-server versions 5.2.5 and earlier crashes the entire Node.js process when an unauthenticated peer sends a malformed Host header in an HTTP request or a malformed Origin header in a WebSocket upgrade. The malformed value triggers an uncaught exception in the host-validation path, crashing the dev server.
- CVE-2026-9595Medium
A vulnerability in webpack-dev-server allows for the interception of browser cookies and the Origin header when a user-configured proxy has a broad context and ws: true enabled. This leads to bypassing Host/Origin validation and corrupting the HMR socket.
Original NVD description (English source)
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS