Executive brief
webpack-dev-server is a tool used by developers to preview and test web applications during development. A configuration issue allows the server to accidentally forward internal communication data to external backend servers. This could lead to the leakage of sensitive browser cookies and connection details to unauthorized third parties, or cause the development server to stop responding correctly.
Technical details
A vulnerability exists in webpack-dev-server where a user-configured proxy with a broad context (e.g., '/') and 'ws: true' enabled will intercept the server's internal Hot Module Replacement (HMR) WebSocket. This occurs because the proxy takes precedence and forwards the HMR traffic to the defined proxy target. This behavior results in the leakage of the browser's 'Cookie' and 'Origin' headers to the backend, bypasses Host/Origin validation, and causes socket corruption as both the HMR service and the proxy attempt to write to the same socket. The issue is fixed in version 5.2.5 by ensuring internal HMR requests are not intercepted by broad user proxies.
Affected products
- webpack webpack-dev-server < 5.2.5
Timeline
- 2026-06-15: disclosed
- 2026-06-17: advisory
- 2026-06-15: patched: Fixed in version 5.2.5