CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2026-14631
Medium (5.3) in webpack.js webpack-dev-server. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in webpack-dev-server 5.2.6.
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-20, CWE-248
- Published
- Modified
- Record from
- the NVD, synced
Affected
- webpack.js:webpack-dev-server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m28w-2pqf-7qgj | npm | webpack-dev-server | <5.2.6 | 5.2.6 |