Cross-Origin Source Code Exposure in webpack-dev-server by Webpack

CVE-2026-6402

What is CVE-2026-6402?

The vulnerability in webpack-dev-server affects versions up to and including 5.2.3, allowing attackers to exploit cross-origin source code exposure when served over untrusted origins like plain HTTP. This issue arises from the inability of traditional security headers, such as Sec-Fetch-Mode and Sec-Fetch-Site, to be included in requests from non-trustworthy origins. Consequently, an attacker can manipulate a website to retrieve application source code from a developer's machine running the vulnerable server configuration. It is crucial to upgrade to webpack-dev-server version 5.2.4 or later to implement the Cross-Origin-Resource-Policy: same-origin on responses, mitigating this risk effectively.

References