webpack-dev-server vulnerabilities

CVEs whose affected-version data names the webpack-dev-server package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-114348Medium· 5.3

1w ago

webpack-dev-server: webpack-dev-server: Information disclosure via malformed Host header (CVE-2026-114348)

A flaw was found in webpack-dev-server. An unauthenticated remote attacker can exploit improper Host header validation in the open-editor endpoint to obtain sensitive technical information. By sending a request with a specially crafted Hos…

▾ SunlitRed Hat · webpack-dev-serverEPSS 0.30%via CSAF

CVE-2026-112085High· 8.2

1w ago

webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket up…

▾ Twilightwebpack-dev-server · webpack-dev-serverEPSS 0.15%via CVEORG

CVE-2026-9595Medium· 5.3

4mo ago

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

▾ Sunlitwebpack-dev-server · webpack-dev-serverEPSS 0.16%via GHSA