Executive brief
webpack-dev-server is a tool used by developers to serve and automatically reload web applications during development. A vulnerability exists where a malicious website visited by a developer can steal the application's source code if the development server is running over an insecure HTTP connection. This could lead to the exposure of intellectual property or sensitive logic contained within the application's frontend code.
Technical details
webpack-dev-server versions up to 5.2.3 are vulnerable to cross-origin source code exposure when running over plain HTTP. A previous security fix relied on 'Sec-Fetch-Mode' and 'Sec-Fetch-Site' headers to block unauthorized cross-origin requests; however, browsers omit these headers for non-trustworthy (non-HTTPS) origins, effectively bypassing the protection. An attacker can exploit this by hosting a malicious site that loads the developer's local JavaScript bundles via script tags and intercepts the webpack runtime's module registration to read the source code. This attack requires the attacker to guess the host and port of the dev server and requires user interaction (the developer visiting a malicious site). Chromium-based browsers (Chrome 142+) are mitigated by local network access restrictions. The issue is fixed in version 5.2.4 by implementing the 'Cross-Origin-Resource-Policy: same-origin' header.
Affected products
- webpack webpack-dev-server <= 5.2.3
Timeline
- 2026-05-11: advisory: GitHub advisory published by maintainers
- 2026-05-12: disclosed: CVE-2026-6402 published