Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process. Patches Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #5699). Workarounds Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Recommended action: Upgrade to 5.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine. Patches Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #5698). Workarounds None
Recommended action: Upgrade to 5.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches Fixed in webpack-dev-server 5.2.5. Workarounds Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Recommended action: Upgrade to 5.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When webpack-dev-server is running on a non-HTTPS origin (the default), cross-origin requests from malicious websites can load the dev server's JavaScript bundles via <script tags. The fix introduced in v5.2.1 (CVE-2025-30359) relied on Sec-Fetch-Mode and Sec-Fetch-Site request headers to block these requests, but browsers only send these headers for potentially trustworthy origins. Over plain HTTP, the headers are absent and the check is bypassed. An attacker who knows the dev server's host, port, and output path can exfiltrate all module source code by intercepting the webpack runtime's module registration. This does not affect Chrome 142+ (and other Chromium-based browsers) due to local network access restrictions. Patches Patched in webpack-dev-server = 5.2.4 by setting Cross-Origin-Resource-Policy: same-origin on responses. Workarounds Run the dev server with HTTPS enabled (--https or server.type: 'https' in config). Resources - GHSA-4v9v-hfq4-rm2v (CVE-2025-30359) -…
Recommended action: Upgrade to 5.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Source code may be stolen when you access a malicious web site with non-Chromium based browser. Details The Origin header is checked to prevent Cross-site WebSocket hijacking from happening which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address Origin headers. https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127 This allows websites that are served on IP addresses to connect WebSocket. By using the same method described in the article linked from CVE-2018-14732, the attacker get the source code. related commit: https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb (note that checkHost function was only used for Host header to prevent DNS rebinding attacks so this change itself is fine. This vulnerability does not affect Chrome 94+ (and other Chromium based browsers) users due to the non-HTTPS private access blocking feature. PoC 1. Download…
Recommended action: Upgrade to 5.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Source code may be stolen when you access a malicious web site. Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject <script src="http://localhost:8080/main.js" in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using Function::toString against the values in webpackmodules, the attacker can get the source code. PoC 1. Download reproduction.zip and extract it 2. Run npm i 3. Run npx webpack-dev-server 4. Open https://e29c9a88-a242-4fb4-9e64-b24c9d29b35b.pages.dev/ 5. You can see the source code output in the document and the devtools console. The script in the POC site is: This script uses the function generated by renderRequire. Especially, it uses the fact that Array::forEach is called for webpackrequire.i and execOptions contains…
Recommended action: Upgrade to 5.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated. Recommendation For webpack-dev-server update to version 3.1.11 or later.
Recommended action: Upgrade to 3.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.