# CVE-2025-30359: webpack-dev-server source code disclosure via cross-origin requests

Source: https://junglewise.ai/threats/cve-2025-30359-webpack-dev-server-source-code-disclosure-via-cross-origin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-30359 · Severity: low · CVSS 3.1 · Published 2025-06-04

webpack-dev-server is a development tool used by JavaScript developers to test applications locally during development. Attackers can trick developers into visiting a malicious website, which then silently extracts the developer's source code by leveraging loose cross-origin policies and prototype pollution. This could expose proprietary business logic, API keys, and other sensitive information embedded in the code.

Technologies: [webpack-dev-server (npm)](https://junglewise.ai/threats/technologies/webpack-dev-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-30359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-30359 being exploited in the wild.

**How severe is CVE-2025-30359?** Low severity, with a CVSS score of 3.1, published 4 June 2025.

**Which products and versions are affected?** webpack-dev-server (npm) SEMVER:introduced=0,fixed=5.2.1.

**Is there a fix for CVE-2025-30359?** Yes. webpack-dev-server (npm): upgrade to 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-30359 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-30359?** Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- webpack-dev-server (npm): upgrade to 5.2.1 or later

  ```sh
  npm install webpack-dev-server@5.2.1
  ```


## Technical details

The vulnerability is a cross-origin information disclosure (CWE-749) affecting webpack-dev-server. The root cause is that webpack-dev-server does not enforce proper CORS headers, allowing classic script tags from arbitrary origins to load and execute bundled code. An attacker can inject a <script src="http://localhost:PORT/ENTRYPOINT"> tag from a malicious website; because classic script requests bypass same-origin policy, the script loads and executes in the attacker's page context. By combining this with prototype pollution attacks against Array.prototype.forEach, an attacker gains access to the __webpack_require__ function and the __webpack_modules__ object. Using Function::toString() against these objects exposes complete source code. The attack requires the developer to: (1) visit a malicious website while webpack-dev-server is running, and (2) the attacker to guess or know the port number and output entrypoint script path. The fix, available in version 5.2.1, adds cross-origin request validation and requires Access-Control-Allow-Origin headers for cross-origin requests.

## Affected products

- webpack webpack-dev-server <= 5.2.0

## Identifiers

- CVE-2025-30359
- GHSA-4v9v-hfq4-rm2v

## Timeline

- 2025-06-03: disclosed
- 2025-06-04: patched: Fixed in version 5.2.1

## References

- [https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v](https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v)
- [https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e](https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e)
- [https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239](https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239)
- [https://github.com/webpack/webpack-dev-server](https://github.com/webpack/webpack-dev-server)

## Related threats

- [webpack webpack-dev-server Denial of Service via malformed headers](https://junglewise.ai/threats/cve-2026-14631-webpack-webpack-dev-server-denial-of-service-via-malformed)
- [webpack webpack-dev-server CSRF in developer endpoints](https://junglewise.ai/threats/cve-2026-14620-webpack-webpack-dev-server-csrf-in-developer-endpoints)
- [webpack-dev-server HMR WebSocket interception via permissive proxies](https://junglewise.ai/threats/cve-2026-9595-webpack-dev-server-hmr-websocket-interception-via-permissive)
- [webpack webpack-dev-server cross-origin source code exposure](https://junglewise.ai/threats/cve-2026-6402-webpack-webpack-dev-server-cross-origin-source-code-exposure)
- [webpack-dev-server source code disclosure via WebSocket in non-Chromium browsers](https://junglewise.ai/threats/cve-2025-30360-webpack-dev-server-source-code-disclosure-via-websocket-in-non)