CVE-2026-9595
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in webpack-dev-server allows for the interception of browser cookies and the Origin header when a user-configured proxy has a broad context and ws: true enabled. This leads to bypassing Host/Origin validation and corrupting the HMR socket.
Risk Assessment
Organizations may be exposed to user data leaks and man-in-the-middle attacks, potentially leading to serious security breaches.
Recommendation
It is recommended to scope the proxy context to specific paths instead of using / or to omit ws: true when WebSocket forwarding is not required.
Other vulnerabilities in webpack-dev-server
See all- CVE-2026-114348Medium
webpack-dev-server versions 5.1.0 before 5.2.7 and version 6.0.0 have an unauthenticated open-editor endpoint that validates the Host header with a regular expression meant for browser Origin schemes. A Host value beginning with file: or an extension scheme bypasses hostname and allowedHosts checks, and URL construction throws. In default non-production mode the server returns HTTP 500 with a full stack trace, disclosing filesystem paths, module locations, and source line numbers.
- CVE-2026-112085High
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback.
- CVE-2026-14631Medium
A vulnerability in webpack-dev-server versions 5.2.5 and earlier crashes the entire Node.js process when an unauthenticated peer sends a malformed Host header in an HTTP request or a malformed Origin header in a WebSocket upgrade. The malformed value triggers an uncaught exception in the host-validation path, crashing the dev server.
- CVE-2026-14620Medium
A vulnerability in webpack-dev-server versions 5.2.5 and earlier allows an attacker to perform unauthorized actions on the dev server by sending GET requests to internal endpoints. The attack requires no user interaction beyond the developer visiting a malicious website while the dev server is running.
Original NVD description (English source)
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in [email protected]. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS