High severity · published Sep 21, 2018
CVE-2018-14732
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6
7.5
CVSS
2.5%
EPSS
No
On KEV
Description
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webpack-dev-server · Webpack.js
before 3.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14732
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14732
Exploit
https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages
Patch
https://github.com/webpack/webpack-dev-server/commit/f18e5adf123221a1015be63e1ca2491ca45b8d10
Exploit
https://github.com/webpack/webpack-dev-server/issues/1445
More from Webpack-dev-server
6.5
CVE-2026-6402
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
6.5
CVE-2025-30360
webpack-dev-server allows users to use webpack with a development server that provides live reloading
5.9
CVE-2025-30359
webpack-dev-server allows users to use webpack with a development server that provides live reloading
5.3
CVE-2026-14631
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
4.7
CVE-2026-14620
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints