CVE-2025-30359: webpack-dev-server source code disclosure via cross-origin requests

CVE-2025-30359 · Severity: low · CVSS 3.1 · Published 2025-06-04

webpack-dev-server is a development tool used by JavaScript developers to test applications locally during development. Attackers can trick developers into visiting a malicious website, which then silently extracts the developer's source code by leveraging loose cross-origin policies and prototype pollution. This could expose proprietary business logic, API keys, and other sensitive information embedded in the code.

Technologies: webpack-dev-server (npm). Vendors: npm.

Quick answers

Is CVE-2025-30359 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-30359 being exploited in the wild.
How severe is CVE-2025-30359?
Low severity, with a CVSS score of 3.1, published 4 June 2025.
Which products and versions are affected?
webpack-dev-server (npm) SEMVER:introduced=0,fixed=5.2.1.
Is there a fix for CVE-2025-30359?
Yes. webpack-dev-server (npm): upgrade to 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30359 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-30359?
Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • webpack-dev-server (npm): upgrade to 5.2.1 or later
    npm install webpack-dev-server@5.2.1

Technical details

The vulnerability is a cross-origin information disclosure (CWE-749) affecting webpack-dev-server. The root cause is that webpack-dev-server does not enforce proper CORS headers, allowing classic script tags from arbitrary origins to load and execute bundled code. An attacker can inject a <script src="http://localhost:PORT/ENTRYPOINT"> tag from a malicious website; because classic script requests bypass same-origin policy, the script loads and executes in the attacker's page context. By combining this with prototype pollution attacks against Array.prototype.forEach, an attacker gains access to the __webpack_require__ function and the __webpack_modules__ object. Using Function::toString() against these objects exposes complete source code. The attack requires the developer to: (1) visit a malicious website while webpack-dev-server is running, and (2) the attacker to guess or know the port number and output entrypoint script path. The fix, available in version 5.2.1, adds cross-origin request validation and requires Access-Control-Allow-Origin headers for cross-origin requests.

Affected products

  • webpack webpack-dev-server <= 5.2.0

Identifiers

  • CVE-2025-30359
  • GHSA-4v9v-hfq4-rm2v

Timeline

  • 2025-06-03: disclosed
  • 2025-06-04: patched: Fixed in version 5.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.