webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
Published May 12, 2026
6.5
MEDIUMCVSS 3.1
EPSS 0.35%
Description
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.
Affected products
-
- Version 0StatusaffectedConstraints<5.2.4
- Version 5.2.4StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Webpack-Dev-Server | Webpack-Dev-Server | unaffected |
|
- < 5.2.4
No data.
Cryostat 4
cryostat-openshift-console-plugin-npm
Fix deferred
Cryostat 4
webpack-dev-server
Fix deferred
Gatekeeper 3
gatekeeper/gatekeeper-rhel9
Fix deferred
Migration Toolkit for Containers
rhmtc/openshift-migration-ui-rhel8
Fix deferred
Node HealthCheck Operator
workload-availability/node-healthcheck-must-gather-rhel9
Fix deferred
Node HealthCheck Operator
workload-availability/node-healthcheck-operator-bundle
Fix deferred
Node HealthCheck Operator
workload-availability/node-healthcheck-rhel9-operator
Fix deferred
OpenShift Lightspeed
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
Fix deferred
OpenShift Lightspeed
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
Fix deferred
OpenShift Lightspeed
openshift-lightspeed/lightspeed-console-plugin-rhel9
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-console-plugin-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-console-plugin-rhel9
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-ui-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-ui-rhel9
Fix deferred
OpenShift Service Mesh 2
openshift-service-mesh/kiali-ossmc-rhel8
Fix deferred
OpenShift Service Mesh 2
openshift-service-mesh/kiali-rhel8
Fix deferred
OpenShift Service Mesh 3
openshift-service-mesh/kiali-operator-bundle
Fix deferred
OpenShift Service Mesh 3
openshift-service-mesh/kiali-ossmc-rhel9
Fix deferred
OpenShift Service Mesh 3
openshift-service-mesh/kiali-rhel9
Fix deferred
OpenShift Service Mesh 3
openshift-service-mesh/kiali-rhel9-operator
Fix deferred
Red Hat AMQ Broker 7
webpack-dev-server
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-24/lightspeed-rhel8
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-25/lightspeed-rhel8
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/gateway-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/lightspeed-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
automation-eda-controller
Fix deferred
Red Hat Build of Podman Desktop
rh-podman-desktop.git
Fix deferred
Red Hat Data Grid 8
webpack-dev-server
Fix deferred
Red Hat Developer Hub
rhdh/rhdh-hub-rhel9
Fix deferred
Red Hat Discovery 2
discovery/discovery-ui-rhel9
Fix deferred
Red Hat Enterprise Linux 10
grafana
Out of support scope
Red Hat Enterprise Linux 10
js-d3-flame-graph
Fix deferred
Red Hat Enterprise Linux 10
pcs
Fix deferred
Red Hat Enterprise Linux 8
grafana
Fix deferred
Red Hat Enterprise Linux 8
pcs
Fix deferred
Red Hat Enterprise Linux 9
grafana
Fix deferred
Red Hat Enterprise Linux 9
js-d3-flame-graph
Fix deferred
Red Hat Enterprise Linux 9
pcs
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-cuda-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-rocm-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/disk-image-cuda-rhel9
Fix deferred
Red Hat Fuse 7
webpack-dev-server
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mlflow-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-console-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/kubevirt-console-plugin
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/kubevirt-console-plugin-rhel9
Fix deferred
Red Hat Process Automation 7
webpack-dev-server
Fix deferred
Red Hat Quay 3
quay/quay-rhel8
Fix deferred
Red Hat build of Apache Camel - HawtIO 4
webpack-dev-server
Fix deferred
Red Hat build of Apache Camel for Spring Boot 4
webpack-dev-server
Fix deferred
Red Hat build of Apicurio Registry 2
webpack-dev-server
Fix deferred
Self-service automation portal 2
ansible-automation-platform/automation-portal
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Fix deferred | n/a |
| Cryostat 4 | webpack-dev-server | Fix deferred | n/a |
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Fix deferred | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-must-gather-rhel9 | Fix deferred | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-operator-bundle | Fix deferred | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-rhel9-operator | Fix deferred | n/a |
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-console-plugin-419-rhel9 | Fix deferred | n/a |
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 | Fix deferred | n/a |
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-console-plugin-rhel9 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel9 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-ui-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-ui-rhel9 | Fix deferred | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/kiali-ossmc-rhel8 | Fix deferred | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/kiali-rhel8 | Fix deferred | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-operator-bundle | Fix deferred | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-ossmc-rhel9 | Fix deferred | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-rhel9 | Fix deferred | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-rhel9-operator | Fix deferred | n/a |
| Red Hat AMQ Broker 7 | webpack-dev-server | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/lightspeed-rhel8 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-rhel8 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/lightspeed-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller | Fix deferred | n/a |
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Fix deferred | n/a |
| Red Hat Data Grid 8 | webpack-dev-server | Fix deferred | n/a |
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Fix deferred | n/a |
| Red Hat Discovery 2 | discovery/discovery-ui-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | grafana | Out of support scope | n/a |
| Red Hat Enterprise Linux 10 | js-d3-flame-graph | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | pcs | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | grafana | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | pcs | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | grafana | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | js-d3-flame-graph | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | pcs | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-rocm-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/disk-image-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Fuse 7 | webpack-dev-server | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/kubevirt-console-plugin | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/kubevirt-console-plugin-rhel9 | Fix deferred | n/a |
| Red Hat Process Automation 7 | webpack-dev-server | Fix deferred | n/a |
| Red Hat Quay 3 | quay/quay-rhel8 | Fix deferred | n/a |
| Red Hat build of Apache Camel - HawtIO 4 | webpack-dev-server | Fix deferred | n/a |
| Red Hat build of Apache Camel for Spring Boot 4 | webpack-dev-server | Fix deferred | n/a |
| Red Hat build of Apicurio Registry 2 | webpack-dev-server | Fix deferred | n/a |
| Self-service automation portal 2 | ansible-automation-platform/automation-portal | Fix deferred | n/a |
webpack-dev-server
npm
Introduced 0 Fixed 5.2.4
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | webpack-dev-server | 0 | 5.2.4 |
Remediation
No remediation recorded yet.
References (10)
- https://access.redhat.com/security/cve/CVE-2026-6402 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2476411 Issue Tracking
- https://cna.openjsf.org/security-advisories.html Vendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29404 Advisory
- https://github.com/advisories/GHSA-79cf-xcqc-c78w Advisory
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w MitigationVendor Advisory
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h
- https://nvd.nist.gov/vuln/detail/CVE-2026-6402
- https://www.cve.org/CVERecord?id=CVE-2026-6402
Change history (0)
No recorded changes yet.