ROOT-APP-NPM-CVE-2026-6402 CVE-2026-6402 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-6402 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-30359 CVE-2025-30359 in webpack-dev-server - Patched by Root

Root has patched CVE-2025-30359 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-14620 CVE-2026-14620 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-14620 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-30360 CVE-2025-30360 in webpack-dev-server - Patched by Root

Root has patched CVE-2025-30360 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9595 CVE-2026-9595 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-9595 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

CLSA-2026-1786365773 TuxCare security update for webpack-dev-server (4 CVEs)

TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 3.11.3-tuxcare.4...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-14631 DESCRIPTION:...

GHSA-M28W-2PQF-7QGJ webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +326 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =1.0.17 and more Source cves: CVE-2026-14631 Source advisory:...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +326 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =1.0.17 and more Source cves: CVE-2026-14620 Source advisory:...

GHSA-F5VJ-F2HX-8M93 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

EUVD-2026-41558

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.2 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

SUSE CVE-2026-14631

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught...

Linux Distros Unpatched Vulnerability : CVE-2026-14620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev- server/open-editor and /webpack-dev-server/invalidate, that...

CVE-2026-14631

A flaw was found in webpack-dev-server. An unauthenticated remote attacker could send a specially crafted HTTP request with a malformed Host header or a WebSocket upgrade with a malformed Origin header. This malformed input causes an uncaught exception, leading to the termination of the Node.js...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +326 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =1.0.17 and more Source cves: CVE-2026-14631 Source advisory:...

Improper Input Validation

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Improper Input Validation through the host-validation process. An attacker can cause the server to...