Executive brief
webpack-dev-server is a development server commonly used by JavaScript developers to test applications locally. A flaw in its WebSocket connection validation allows a malicious website to steal source code from developers using non-Chromium browsers (such as Firefox). An attacker can serve a webpage on an IP address that tricks the development server into establishing a WebSocket connection and sending complete source code to the attacker.
Technical details
The vulnerability stems from insufficient origin validation in the WebSocket handshake. webpack-dev-server checks the Origin header to prevent Cross-Site WebSocket Hijacking (CSWH) but always permits origins with valid IPv4 or IPv6 addresses. An attacker serving a malicious site on an IP address can connect to a developer's local webpack-dev-server instance via WebSocket, triggering the HMR (Hot Module Replacement) mechanism to send hot-update bundles containing complete source code. The attack requires the developer to visit the malicious site in a non-Chromium browser and assumes a predictable listening port. Chromium-based browsers (Chrome 94+) are protected by the non-HTTPS private access blocking feature. The fix is available in webpack-dev-server version 5.2.1 and later.
Affected products
- webpack webpack-dev-server <=5.2.0
Timeline
- 2025-06-03: disclosed
- 2025-06-04: patched: Fixed in webpack-dev-server 5.2.1