WE
Product
webpack-dev-server
6
CVEs
0
On KEV
8.2
Max CVSS
2
New 30D
Severity mix
Critical 0High 1Medium 5Low 0
Watch
Add webpack-dev-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-112085 New | 8.2 | Oct 22 | webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades Affected: before 5.2.7; 6.0.0 before 6.1.0 |
| CVE-2026-6402 | 6.5 | May 12 | webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins Affected: before 5.2.4 |
| CVE-2026-114348 New | 5.3 | Oct 22 | webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint Affected: 5.1.0 before 5.2.7; 6.0.0 before 6.1.0 |
| CVE-2026-14631 | 5.3 | Jul 3 | webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header Affected: before 5.2.6 |
| CVE-2026-14620 | 4.7 | Jul 3 | webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints Affected: before 5.2.6 |
| CVE-2026-9595 | 4.3 | Jun 15 | webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies Affected: before 5.2.5 |
Showing 6