Webpack.js / Webpack-Dev-Server
7 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-14631 | webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header | MEDIUM | 5.3 | Jul 3, 2026 |
| CVE-2026-14620 | webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints | MEDIUM | 4.7 | Jul 3, 2026 |
| CVE-2026-9595 | webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies | HIGH | 7.1 | Jun 15, 2026 |
| CVE-2026-6402 | webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins | MEDIUM | 6.5 | May 12, 2026 |
| CVE-2025-30360 | webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser | MEDIUM | 6.5 | Jun 3, 2025 |
| CVE-2025-30359 | webpack-dev-server users' source code may be stolen when they access a malicious web site | MEDIUM | 5.9 | Jun 3, 2025 |
| CVE-2018-14732 | An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not… | HIGH | 7.5 | Sep 21, 2018 |
Showing 1 to 7 of 7 CVEs