CLEANSTART-2026-ZQ29931 Impact: When a user-configured proxy on webpack-dev-server has a broad context (e

Security vulnerability affects the argo-workflows package. Impact: When a user-configured proxy on webpack-dev-server has a broad context e...

CLEANSTART-2026-OV07836 webpack-dev-server versions up to and including 5

Security vulnerability affects the argo-workflows package. webpack-dev-server versions up to and including 5...

CLEANSTART-2026-DP98165 webpack-dev-server versions 5

Security vulnerability affects the argo-workflows package. webpack-dev-server versions 5...

CLEANSTART-2026-CT04266 webpack-dev-server versions 5

Security vulnerability affects the argo-workflows package. webpack-dev-server versions 5...

CLEANSTART-2026-WE25839 webpack-dev-server allows users to use webpack with a development server that provides live reloading

Security vulnerability affects the argo-workflows package. webpack-dev-server allows users to use webpack with a development server that provides live reloading...

CLEANSTART-2026-QR06978 webpack-dev-server allows users to use webpack with a development server that provides live reloading

Security vulnerability affects the argo-workflows package. webpack-dev-server allows users to use webpack with a development server that provides live reloading...

CLEANSTART-2026-BQ58888 webpack-dev-server versions up to and including 5

Security vulnerability affects the argo-workflows package. webpack-dev-server versions up to and including 5...

CLEANSTART-2026-DQ77720 webpack-dev-server allows users to use webpack with a development server that provides live reloading

Security vulnerability affects the argo-workflows package. webpack-dev-server allows users to use webpack with a development server that provides live reloading...

CLEANSTART-2026-IT38268 Impact: When a user-configured proxy on webpack-dev-server has a broad context (e

Security vulnerability affects the argo-workflows package. Impact: When a user-configured proxy on webpack-dev-server has a broad context e...

Linux Distros Unpatched Vulnerability : CVE-2026-112085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry ...

Linux Distros Unpatched Vulnerability : CVE-2026-114348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the...

UBUNTU-CVE-2026-112085

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Ho...

UBUNTU-CVE-2026-114348

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value...

CVE-2026-112085

A flaw was found in webpack-dev-server. When configured to forward WebSocket connections through a proxy, the server does not validate incoming Host or Origin headers on connection upgrade requests. A remote attacker could exploit this by enticing a user to visit a malicious website, enabling the...

SUSE CVE-2026-112085

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Ho...

SUSE CVE-2026-114348

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value...

@all-star/base (0.23.6), @all-star/react (0.23.6) +35 more potentially affected by CVE-2026-112085 via webpack-dev-server (6.0.0)

webpack-dev-server NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on webpack-dev-server and may be impacted: - @all-star/base 0.23.6 - @all-star/react 0.23.6 - @all-star/vue 0.23.6 - @angular-builders/custom-webpack =22.0.0-beta.0,...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +330 more potentially affected by CVE-2026-112085 via webpack-dev-server (>=5.0.0, <=5.2.6)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.18.5 and more Source cves: CVE-2026-112085 Source advisory:...

Origin Validation Error

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Origin Validation Error via the WebSocket upgrade handler in lib/Server.js when a devServer.proxy entr...

Information Exposure

Overview org.webjars.npm:webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Information Exposure via the isValidHost method in lib/Server.js, where Host and...