Is CVE-2026-114348 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114348 being exploited in the wild.

How severe is CVE-2026-114348?

Medium severity, with a CVSS score of 5.3, published 22 October 2026.

Which products and versions are affected?

Webpack-Dev-Server 5.1.0 before 5.2.7, 6.0.0 before 6.1.0.

Is there a fix for CVE-2026-114348?

Yes: fixed in webpack-dev-server 5.2.7, 6.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114348 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114348?

Check whether you run Webpack-Dev-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114348: webpack-dev-server information disclosure via Host validation bypass

CVE-2026-114348 · Severity: medium · CVSS 5.3 · Published 2026-10-22

webpack-dev-server is a development tool that provides live reloading for JavaScript projects during development. An attacker on the network can send a specially crafted request to the dev server's unauthenticated open-editor endpoint using a malformed Host header that bypasses validation. This causes the server to expose sensitive information such as absolute file paths, installed package locations, and source code line numbers in the HTTP error response, potentially aiding further attacks.

Technologies: Webpack-Dev-Server. Vendors: Webpack.

Quick answers

Is CVE-2026-114348 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114348 being exploited in the wild.
How severe is CVE-2026-114348?: Medium severity, with a CVSS score of 5.3, published 22 October 2026.
Which products and versions are affected?: Webpack-Dev-Server 5.1.0 before 5.2.7, 6.0.0 before 6.1.0.
Is there a fix for CVE-2026-114348?: Yes: fixed in webpack-dev-server 5.2.7, 6.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114348 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114348?: Check whether you run Webpack-Dev-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: webpack-dev-server 5.2.7, 6.1.0

Technical details

The vulnerability exists in the Host header validation regex used by the /webpack-dev-server/open-editor endpoint, which incorrectly treats file: and browser extension schemes as valid, allowing them to bypass hostname and allowedHosts checks. When a network-accessible attacker sends a request with a malformed Host like "file:badport", the endpoint's URL construction throws an exception that, in non-production mode, is returned in the HTTP 500 response body with full stack traces containing filesystem paths and internal implementation details. The server continues running without denial of service.

Affected products

webpack webpack-dev-server 5.1.0 before 5.2.7, 6.0.0 before 6.1.0

Timeline

2026-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.