WebSocket Vulnerability in webpack-dev-server by webpack
CVE-2026-112085

8.2HIGH

Key Information:

Vendor

Webpack-dev-server

Status
Webpack-dev-server
Vendor
CVE Published:
22 October 2026

What is CVE-2026-112085?

The webpack-dev-server is designed for development purposes, providing live reloading capabilities. However, versions prior to 5.2.7 and version 6.0.0 possess a vulnerability where non-HMR WebSocket upgrade requests are forwarded to a proxy target without proper validation of Host or Origin headers. This flaw allows for the possibility of cross-origin WebSocket connections from a malicious web page, enabling unauthorized access to the proxied backend. The issue has been resolved in versions 5.2.7 and 6.1.0, where proper validation is enforced. Users should upgrade immediately or work around this issue by avoiding unnecessary WebSocket forwarding in their proxy configurations.

Affected Version(s)

webpack-dev-server 0 < 5.2.7

webpack-dev-server 6.0.0 < 6.1.0

webpack-dev-server 5.2.7

References

https://github.com/webpack/webpack-dev-server/security/ad...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

euriconicacio
UlisesGascon
bjohansebas
alexander-akait
.