webpack/webpack-dev-server Security Advisories | GitStock

medium2026-07-20

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

GHSA-m28w-2pqf-7qgj · CVE-2026-14631

medium2026-07-20

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

GHSA-f5vj-f2hx-8m93 · CVE-2026-14620

medium2026-06-17

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

GHSA-mx8g-39q3-5c79 · CVE-2026-9595

medium2026-05-18

webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

GHSA-79cf-xcqc-c78w · CVE-2026-6402

medium2025-06-04

webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

GHSA-9jgg-88mc-972h · CVE-2025-30360

medium2025-06-04

webpack-dev-server users' source code may be stolen when they access a malicious web site

GHSA-4v9v-hfq4-rm2v · CVE-2025-30359