Webpack-dev-server Webpack-dev-server
4 CVEs affecting Webpack-dev-server Webpack-dev-server. Latest disclosed: 2026-07-03. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14631 | Medium | 5.3 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malfor… |
CVE-2026-9595 | Medium | 5.3 | 2026-06-15 | Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and… |
CVE-2026-6402 | Medium | 5.3 | 2026-05-12 | webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origi… |
CVE-2026-14620 | Medium | 4.7 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that… |