# CVE-2026-9595: webpack-dev-server HMR WebSocket interception via permissive proxies

Source: https://junglewise.ai/threats/cve-2026-9595-webpack-dev-server-hmr-websocket-interception-via-permissive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-9595 · Severity: medium · CVSS 5.3 · Published 2026-06-15

webpack-dev-server is a tool used by developers to preview and test web applications during development. A configuration issue allows the server to accidentally forward internal communication data to external backend servers. This could lead to the leakage of sensitive browser cookies and connection details to unauthorized third parties, or cause the development server to stop responding correctly.

Technologies: [webpack-dev-server (npm)](https://junglewise.ai/threats/technologies/webpack-dev-server), [Webpack Dev-Server](https://junglewise.ai/threats/technologies/dev-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Webpack](https://junglewise.ai/threats/vendors/webpack).

## Quick answers

**Is CVE-2026-9595 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9595 being exploited in the wild.

**How severe is CVE-2026-9595?** Medium severity, with a CVSS score of 5.3, published 15 June 2026.

**Which products and versions are affected?** webpack-dev-server (npm) < 5.2.5, SEMVER:introduced=0,fixed=5.2.5; Webpack Dev-Server < 5.2.5.

**Is there a fix for CVE-2026-9595?** Yes. webpack-dev-server (npm): upgrade to 5.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9595 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9595?** Check whether you run webpack-dev-server (npm) or Webpack Dev-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- webpack-dev-server (npm): upgrade to 5.2.5 or later

  ```sh
  npm install webpack-dev-server@5.2.5
  ```


## Technical details

A vulnerability exists in webpack-dev-server where a user-configured proxy with a broad context (e.g., '/') and 'ws: true' enabled will intercept the server's internal Hot Module Replacement (HMR) WebSocket. This occurs because the proxy takes precedence and forwards the HMR traffic to the defined proxy target. This behavior results in the leakage of the browser's 'Cookie' and 'Origin' headers to the backend, bypasses Host/Origin validation, and causes socket corruption as both the HMR service and the proxy attempt to write to the same socket. The issue is fixed in version 5.2.5 by ensuring internal HMR requests are not intercepted by broad user proxies.

## Affected products

- webpack webpack-dev-server < 5.2.5

## Identifiers

- CVE-2026-9595
- GHSA-mx8g-39q3-5c79

## Timeline

- 2026-06-15: disclosed
- 2026-06-17: advisory
- 2026-06-15: patched: Fixed in version 5.2.5

## References

- [https://api.github.com/users/bjohansebas](https://api.github.com/users/bjohansebas)
- [https://github.com/bjohansebas](https://github.com/bjohansebas)
- [https://api.github.com/users/bjohansebas/gists%7B/gist_id%7D](https://api.github.com/users/bjohansebas/gists%7B/gist_id%7D)
- [https://api.github.com/users/bjohansebas/repos](https://api.github.com/users/bjohansebas/repos)
- [https://avatars.githubusercontent.com/u/103585995?v=4](https://avatars.githubusercontent.com/u/103585995?v=4)
- [https://api.github.com/users/bjohansebas/events%7B/privacy%7D](https://api.github.com/users/bjohansebas/events%7B/privacy%7D)

## Related threats

- [webpack webpack-dev-server Denial of Service via malformed headers](https://junglewise.ai/threats/cve-2026-14631-webpack-webpack-dev-server-denial-of-service-via-malformed)
- [webpack webpack-dev-server CSRF in developer endpoints](https://junglewise.ai/threats/cve-2026-14620-webpack-webpack-dev-server-csrf-in-developer-endpoints)
- [webpack webpack-dev-server cross-origin source code exposure](https://junglewise.ai/threats/cve-2026-6402-webpack-webpack-dev-server-cross-origin-source-code-exposure)
- [webpack-dev-server source code disclosure via WebSocket in non-Chromium browsers](https://junglewise.ai/threats/cve-2025-30360-webpack-dev-server-source-code-disclosure-via-websocket-in-non)
- [webpack-dev-server source code disclosure via cross-origin requests](https://junglewise.ai/threats/cve-2025-30359-webpack-dev-server-source-code-disclosure-via-cross-origin)