# CVE-2025-30360: webpack-dev-server source code disclosure via WebSocket in non-Chromium browsers

Source: https://junglewise.ai/threats/cve-2025-30360-webpack-dev-server-source-code-disclosure-via-websocket-in-non  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-30360 · Severity: low · CVSS 3.1 · Published 2025-06-04

webpack-dev-server is a development server commonly used by JavaScript developers to test applications locally. A flaw in its WebSocket connection validation allows a malicious website to steal source code from developers using non-Chromium browsers (such as Firefox). An attacker can serve a webpage on an IP address that tricks the development server into establishing a WebSocket connection and sending complete source code to the attacker.

Technologies: [webpack-dev-server (npm)](https://junglewise.ai/threats/technologies/webpack-dev-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-30360 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-30360 being exploited in the wild.

**How severe is CVE-2025-30360?** Low severity, with a CVSS score of 3.1, published 4 June 2025.

**Which products and versions are affected?** webpack-dev-server (npm) SEMVER:introduced=0,fixed=5.2.1.

**Is there a fix for CVE-2025-30360?** Yes. webpack-dev-server (npm): upgrade to 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-30360 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-30360?** Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- webpack-dev-server (npm): upgrade to 5.2.1 or later

  ```sh
  npm install webpack-dev-server@5.2.1
  ```


## Technical details

The vulnerability stems from insufficient origin validation in the WebSocket handshake. webpack-dev-server checks the Origin header to prevent Cross-Site WebSocket Hijacking (CSWH) but always permits origins with valid IPv4 or IPv6 addresses. An attacker serving a malicious site on an IP address can connect to a developer's local webpack-dev-server instance via WebSocket, triggering the HMR (Hot Module Replacement) mechanism to send hot-update bundles containing complete source code. The attack requires the developer to visit the malicious site in a non-Chromium browser and assumes a predictable listening port. Chromium-based browsers (Chrome 94+) are protected by the non-HTTPS private access blocking feature. The fix is available in webpack-dev-server version 5.2.1 and later.

## Affected products

- webpack webpack-dev-server <=5.2.0

## Identifiers

- CVE-2025-30360
- GHSA-9jgg-88mc-972h

## Timeline

- 2025-06-03: disclosed
- 2025-06-04: patched: Fixed in webpack-dev-server 5.2.1

## References

- [https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h](https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h)

## Related threats

- [webpack webpack-dev-server Denial of Service via malformed headers](https://junglewise.ai/threats/cve-2026-14631-webpack-webpack-dev-server-denial-of-service-via-malformed)
- [webpack webpack-dev-server CSRF in developer endpoints](https://junglewise.ai/threats/cve-2026-14620-webpack-webpack-dev-server-csrf-in-developer-endpoints)
- [webpack-dev-server HMR WebSocket interception via permissive proxies](https://junglewise.ai/threats/cve-2026-9595-webpack-dev-server-hmr-websocket-interception-via-permissive)
- [webpack webpack-dev-server cross-origin source code exposure](https://junglewise.ai/threats/cve-2026-6402-webpack-webpack-dev-server-cross-origin-source-code-exposure)
- [webpack-dev-server source code disclosure via cross-origin requests](https://junglewise.ai/threats/cve-2025-30359-webpack-dev-server-source-code-disclosure-via-cross-origin)