webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

CLSA-2026-1787931162 TuxCare security update for webpack-dev-server (2 CVEs)

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 5.2.2-tuxcare.1...

CLSA-2026-1787837620 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.2-tuxcare.3...

ROOT-APP-NPM-CVE-2026-6402 CVE-2026-6402 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-6402 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-30359 CVE-2025-30359 in webpack-dev-server - Patched by Root

Root has patched CVE-2025-30359 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-14620 CVE-2026-14620 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-14620 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-30360 CVE-2025-30360 in webpack-dev-server - Patched by Root

Root has patched CVE-2025-30360 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9595 CVE-2026-9595 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-9595 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

CLSA-2026-1786365773 TuxCare security update for webpack-dev-server (4 CVEs)

TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 3.11.3-tuxcare.4...

CLSA-2026-1785204346 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.7.1-tuxcare.4...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-14631 DESCRIPTION:...

GHSA-M28W-2PQF-7QGJ webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +322 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-14631 Source advisory: OSV:GHSA-M28W-2PQF-7Q...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +322 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-14620 Source advisory: OSV:GHSA-F5VJ-F2HX-8M...

GHSA-F5VJ-F2HX-8M93 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

EUVD-2026-41558

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.2 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...