Is CVE-2026-14631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14631 being exploited in the wild.

How severe is CVE-2026-14631?

Medium severity, with a CVSS score of 5.3, published 3 July 2026.

Which products and versions are affected?

webpack-dev-server (npm) <= 5.2.5, SEMVER:introduced=0,fixed=5.2.6.

Is there a fix for CVE-2026-14631?

Yes. webpack-dev-server (npm): upgrade to 5.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14631 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14631?

Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14631: webpack webpack-dev-server Denial of Service via malformed headers

Q: Is there a fix for CVE-2026-14631?

Yes. webpack-dev-server (npm): upgrade to 5.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-14631 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-14631?

Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14631 · Severity: medium · CVSS 5.3 · Published 2026-07-03

webpack-dev-server is a development tool used by software engineers to preview web applications in real-time. A vulnerability in this tool allows an attacker to crash the development server by sending a specially crafted web request. This results in a denial of service, interrupting the development workflow and requiring a manual restart of the server process.

Technologies: webpack-dev-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-14631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14631 being exploited in the wild.
How severe is CVE-2026-14631?: Medium severity, with a CVSS score of 5.3, published 3 July 2026.
Which products and versions are affected?: webpack-dev-server (npm) <= 5.2.5, SEMVER:introduced=0,fixed=5.2.6.
Is there a fix for CVE-2026-14631?: Yes. webpack-dev-server (npm): upgrade to 5.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14631 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14631?: Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

webpack-dev-server (npm): upgrade to 5.2.6 or later
```
npm install webpack-dev-server@5.2.6
```

Technical details

A denial of service vulnerability exists in webpack-dev-server due to improper input validation (CWE-20) and an uncaught exception (CWE-248) in the host-validation path. An unauthenticated remote attacker can trigger a process crash by sending a malformed Host header in a standard HTTP request or a malformed Origin header during a WebSocket upgrade to the /ws endpoint. The vulnerability is exploitable if the dev server is exposed to untrusted networks. The issue is fixed in version 5.2.6 by ensuring malformed headers are treated as invalid rather than throwing an exception.

Affected products

webpack webpack-dev-server <= 5.2.5

Identifiers

CVE-2026-14631
GHSA-m28w-2pqf-7qgj

Timeline

2026-07-03: disclosed: NVD publication date
2026-07-20: advisory: GitHub Advisory published
2026-07-20: patched: Fixed in version 5.2.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.