GHSA-mx8g-39q3-5c79
Medium · 5.3CVSS
5.3
EPSS
—
Published
Jun 17, 2026
CISA due date
—
The record
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | webpack-dev-server | 0 | 5.2.5 |
Related vulnerabilities
- CVE-2026-9595 Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. Same vulnerability
- GHSA-79cf-xcqc-c78w webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins Also affects webpack-dev-server
- CVE-2026-6402 webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin… Also affects webpack-dev-server
- CVE-2025-30359 webpack-dev-server users' source code may be stolen when they access a malicious web site Also affects webpack-dev-server
- CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site… Also affects webpack-dev-server
- CVE-2018-14732 An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Also affects webpack-dev-server
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-346
- CVE-2026-107230 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-346