GHSA-79cf-xcqc-c78w
Medium · 5.3CVSS
5.3
EPSS
—
Published
May 18, 2026
CISA due date
—
The record
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | webpack-dev-server | 0 | 5.2.4 |
Related vulnerabilities
- CVE-2026-6402 webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin… Same vulnerability
- GHSA-mx8g-39q3-5c79 webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies Also affects webpack-dev-server
- CVE-2026-9595 Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. Also affects webpack-dev-server
- CVE-2025-30359 webpack-dev-server users' source code may be stolen when they access a malicious web site Also affects webpack-dev-server
- CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site… Also affects webpack-dev-server
- CVE-2018-14732 An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Also affects webpack-dev-server
- CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation… CWE-749
- CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron… CWE-749