CVE-2026-6402: webpack webpack-dev-server cross-origin source code exposure

CVE-2026-6402 · Severity: medium · CVSS 5.3 · Published 2026-05-12

webpack-dev-server is a tool used by developers to serve and automatically reload web applications during development. A vulnerability exists where a malicious website visited by a developer can steal the application's source code if the development server is running over an insecure HTTP connection. This could lead to the exposure of intellectual property or sensitive logic contained within the application's frontend code.

Technologies: webpack-dev-server (npm), Webpack Dev-Server. Vendors: npm, Webpack.

Quick answers

Is CVE-2026-6402 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6402 being exploited in the wild.
How severe is CVE-2026-6402?
Medium severity, with a CVSS score of 5.3, published 12 May 2026.
Which products and versions are affected?
webpack-dev-server (npm) <= 5.2.3, SEMVER:introduced=0,fixed=5.2.4; Webpack Dev-Server <= 5.2.3.
Is there a fix for CVE-2026-6402?
Yes. webpack-dev-server (npm): upgrade to 5.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6402 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-6402?
Check whether you run webpack-dev-server (npm) or Webpack Dev-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • webpack-dev-server (npm): upgrade to 5.2.4 or later
    npm install webpack-dev-server@5.2.4

Technical details

webpack-dev-server versions up to 5.2.3 are vulnerable to cross-origin source code exposure when running over plain HTTP. A previous security fix relied on 'Sec-Fetch-Mode' and 'Sec-Fetch-Site' headers to block unauthorized cross-origin requests; however, browsers omit these headers for non-trustworthy (non-HTTPS) origins, effectively bypassing the protection. An attacker can exploit this by hosting a malicious site that loads the developer's local JavaScript bundles via script tags and intercepts the webpack runtime's module registration to read the source code. This attack requires the attacker to guess the host and port of the dev server and requires user interaction (the developer visiting a malicious site). Chromium-based browsers (Chrome 142+) are mitigated by local network access restrictions. The issue is fixed in version 5.2.4 by implementing the 'Cross-Origin-Resource-Policy: same-origin' header.

Affected products

  • webpack webpack-dev-server <= 5.2.3

Identifiers

  • CVE-2026-6402
  • GHSA-79cf-xcqc-c78w

Timeline

  • 2026-05-11: advisory: GitHub advisory published by maintainers
  • 2026-05-12: disclosed: CVE-2026-6402 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.