What’s Vulnerable › Products

webpack-dev-server vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your webpack-dev-server version is affected

Latest webpack-dev-server vulnerabilities

• CVE-2026-114348 — webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint (CVSS 5.3)
• CVE-2026-112085 — webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades (CVSS 8.2)
• CVE-2026-14631 — webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header (CVSS 5.3)
• CVE-2026-14620 — webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints (CVSS 4.7)
• CVE-2026-9595 — webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies (CVSS 4.3)
• CVE-2026-6402 — webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins (CVSS 6.5)
• CVE-2025-30360 — webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser (CVSS 6.5)
• CVE-2025-30359 — webpack-dev-server users' source code may be stolen when they access a malicious web site (CVSS 5.9)
• CVE-2018-14732 — (CVSS 7.5)