Webpack-dev-server (Webpack.js) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 169 known versions, newest CVE from 2026-07-03. Vendor: Webpack.js.

CVEs of Webpack-dev-server

• CVE-2026-14631 - CVSS 5.3 (medium), 2026-07-03: webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a…
• CVE-2026-14620 - CVSS 4.7 (medium), 2026-07-03: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate,…
• CVE-2026-9595 - CVSS 5.3 (medium), 2026-06-15: Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket…
• CVE-2026-6402 - CVSS 6.5 (medium), 2026-05-12: webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy…
• CVE-2025-30360 - CVSS 6.5 (medium), 2025-06-03: webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users'…
• CVE-2025-30359 - CVSS 5.9 (medium), 2025-06-03: webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users'…
• CVE-2018-14732 - CVSS 7.5 (high), 2018-09-21: An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is…