Login Request a demo
Medium severity · published Jun 15, 2026
CVE-2026-9595
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
webpack-dev-server · webpack-dev-server
before 5.2.5 · source: vendor, NVD
Affected product
WE
webpack-dev-server
webpack-dev-server
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9595
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9595
Vendor Advisory
https://cna.openjsf.org/security-advisories.html
Issue Tracking
https://github.com/facebook/create-react-app/pull/7444
Patch
https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb
Issue Tracking
https://github.com/webpack/webpack-dev-server/pull/4316
Mitigation
https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79
More from webpack-dev-server
8.2
CVE-2026-112085
webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
6.5
CVE-2026-6402
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
5.3
CVE-2026-114348
webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint
5.3
CVE-2026-14631
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
4.7
CVE-2026-14620
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints