WE
Product
Webpack-dev-server
9
CVEs
0
On KEV
8.2
Max CVSS
2
New 30D
Severity mix
Critical 0High 2Medium 7Low 0
Watch
Add Webpack-dev-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-112085 | 8.2 | Oct 22 | webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades Affected: before 5.2.7; 6.0.0 before 6.1.0 |
| CVE-2018-14732 | 7.5 | Sep 21 | An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6 Affected: before 3.1.6 |
| CVE-2026-6402 | 6.5 | May 12 | webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins Affected: before 5.2.4 |
| CVE-2025-30360 | 6.5 | Jun 3 | webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser Affected: before 5.2.1 |
| CVE-2025-30359 | 5.9 | Jun 3 | webpack-dev-server users' source code may be stolen when they access a malicious web site Affected: before 5.2.1 |
| CVE-2026-114348 | 5.3 | Oct 22 | webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint Affected: 5.1.0 before 5.2.7; 6.0.0 before 6.1.0 |
| CVE-2026-14631 | 5.3 | Jul 3 | webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header Affected: before 5.2.6 |
| CVE-2026-14620 | 4.7 | Jul 3 | webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints Affected: before 5.2.6 |
| CVE-2026-9595 | 4.3 | Jun 15 | webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies Affected: before 5.2.5 |
Showing 9