Unauthenticated Host Header Validation in webpack-dev-server by Webpack

CVE-2026-114348

What is CVE-2026-114348?

The webpack-dev-server contains a vulnerability due to improper validation of the Host header in the open-editor endpoint. When accessed by a network peer, a malformed Host value can bypass validation checks, resulting in the server throwing an exception. This behavior leads to the exposure of critical filesystem information, including absolute paths and source line numbers in the HTTP 500 error response. The server remains operational, and the issue has been addressed in versions 5.2.7 and 6.1.0. Users are strongly advised to upgrade to a patched version.

References