Is CVE-2025-30360 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-30360 being exploited in the wild.

How severe is CVE-2025-30360?

Low severity, with a CVSS score of 3.1, published 4 June 2025.

Which products and versions are affected?

webpack-dev-server (npm) SEMVER:introduced=0,fixed=5.2.1.

Is there a fix for CVE-2025-30360?

Yes. webpack-dev-server (npm): upgrade to 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-30360 attacked?

It is attacked over the network.

Am I affected by CVE-2025-30360?

Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-30360: webpack-dev-server source code disclosure via WebSocket in non-Chromium browsers

CVE-2025-30360 · Severity: low · CVSS 3.1 · Published 2025-06-04

webpack-dev-server is a development server commonly used by JavaScript developers to test applications locally. A flaw in its WebSocket connection validation allows a malicious website to steal source code from developers using non-Chromium browsers (such as Firefox). An attacker can serve a webpage on an IP address that tricks the development server into establishing a WebSocket connection and sending complete source code to the attacker.

Technologies: webpack-dev-server (npm). Vendors: npm.

Quick answers

Is CVE-2025-30360 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-30360 being exploited in the wild.
How severe is CVE-2025-30360?: Low severity, with a CVSS score of 3.1, published 4 June 2025.
Which products and versions are affected?: webpack-dev-server (npm) SEMVER:introduced=0,fixed=5.2.1.
Is there a fix for CVE-2025-30360?: Yes. webpack-dev-server (npm): upgrade to 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30360 attacked?: It is attacked over the network.
Am I affected by CVE-2025-30360?: Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

webpack-dev-server (npm): upgrade to 5.2.1 or later
```
npm install webpack-dev-server@5.2.1
```

Technical details

The vulnerability stems from insufficient origin validation in the WebSocket handshake. webpack-dev-server checks the Origin header to prevent Cross-Site WebSocket Hijacking (CSWH) but always permits origins with valid IPv4 or IPv6 addresses. An attacker serving a malicious site on an IP address can connect to a developer's local webpack-dev-server instance via WebSocket, triggering the HMR (Hot Module Replacement) mechanism to send hot-update bundles containing complete source code. The attack requires the developer to visit the malicious site in a non-Chromium browser and assumes a predictable listening port. Chromium-based browsers (Chrome 94+) are protected by the non-HTTPS private access blocking feature. The fix is available in webpack-dev-server version 5.2.1 and later.

Affected products

webpack webpack-dev-server <=5.2.0

Identifiers

CVE-2025-30360
GHSA-9jgg-88mc-972h

Timeline

2025-06-03: disclosed
2025-06-04: patched: Fixed in webpack-dev-server 5.2.1

References

https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.