CVEvulnerability
CVE-2026-14631
5.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-07-03
- Last modified
- 2026-07-07
- Assigner
- ce714d77-add3-4f53-aff5-83d477b104bb
- CVSS 3.1 (ce714d77-add3-4f53-aff5-83d477b104bb)
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-20, CWE-248
Description
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Affected configurations
• webpack.js webpack-dev-server (< 5.2.6)
Related
References
- https://cna.openjsf.org/security-advisories.html Third Party Advisory
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj Mitigation, Vendor Advisory, Patch