CVE-2026-14631
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
- Record
CVE-2026-14631- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20, CWE-248
- Updated
- 2026-11-02
EUVDEUVD-2026-41559
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
- Record
EUVD-2026-41559- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m28w-2pqf-7qgj
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Impact
An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.
Patches
Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #5699).
Workarounds
Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
- Record
GHSA-m28w-2pqf-7qgj- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20, CWE-248
- Updated
- 2026-11-02
NVD
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
- Record
CVE-2026-14631- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20, CWE-248
- Updated
- 2026-11-02
OSV
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
- Record
CVE-2026-14631- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20, CWE-248
- Updated
- 2026-11-02
OSVGHSA-m28w-2pqf-7qgj
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Impact
An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.
Patches
Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #5699).
Workarounds
Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
- Record
GHSA-m28w-2pqf-7qgj- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20, CWE-248
- Updated
- 2026-11-02
Show 10 moreShow less
OSVCLSA-2026-1784596297 No score
TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.2-tuxcare.2.
- Record
CLSA-2026-1784596297- Updated
- 2026-11-02
OSVCLSA-2026-1785204346 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.7.1-tuxcare.4.
- Record
CLSA-2026-1785204346- Updated
- 2026-11-02
OSVCLSA-2026-1786365627 No score
TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.1-tuxcare.4.
- Record
CLSA-2026-1786365627- Updated
- 2026-11-02
OSVCLSA-2026-1786365773 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 3.11.3-tuxcare.4.
- Record
CLSA-2026-1786365773- Updated
- 2026-11-05
OSVCLSA-2026-1787821986 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4.
- Record
CLSA-2026-1787821986- Updated
- 2026-11-02
OSVCLSA-2026-1787823957 No score
TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.1-tuxcare.3.
- Record
CLSA-2026-1787823957- Updated
- 2026-11-02
OSVCLSA-2026-1787931162 No score
TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 5.2.2-tuxcare.1.
- Record
CLSA-2026-1787931162- Updated
- 2026-11-02
OSVCLSA-2026-1790604947 No score
TuxCare security update for webpack-dev-server (4 CVEs)
TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 4.9.3-tuxcare.1.
- Record
CLSA-2026-1790604947- Updated
- 2026-11-02
OSVCLSA-2026-1790863106 No score
TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 5.2.5-tuxcare.1.
- Record
CLSA-2026-1790863106- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-14631 No score
CVE-2026-14631 in webpack-dev-server - Patched by Root
Root has patched CVE-2026-14631 in the webpack-dev-server package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-14631- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webpack-dev-servernpm |
through 5.2.5 | 5.2.6 |
webpack-dev-serverTuxCare:npm From an advisory covering 2 CVEs |
4.15.2-tuxcare.0 up to 4.15.2-tuxcare.2, plus listed versions 4.15.24.15.2-tuxcare.1 |
4.15.2-tuxcare.2 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
2.7.1-tuxcare.0 up to 2.7.1-tuxcare.4, plus listed versions 2.7.12.7.1-tuxcare.12.7.1-tuxcare.22.7.1-tuxcare.3 |
2.7.1-tuxcare.4 |
webpack-dev-serverTuxCare:npm From an advisory covering 2 CVEs |
4.15.1-tuxcare.0 up to 4.15.1-tuxcare.4, plus listed versions 4.15.14.15.1-tuxcare.14.15.1-tuxcare.24.15.1-tuxcare.3 |
4.15.1-tuxcare.4 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
3.11.3-tuxcare.0 up to 3.11.3-tuxcare.4, plus listed versions 3.11.33.11.3-tuxcare.13.11.3-tuxcare.23.11.3-tuxcare.3 |
3.11.3-tuxcare.4 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
2.11.5-tuxcare.0 up to 2.11.5-tuxcare.4, plus listed versions 2.11.52.11.5-tuxcare.12.11.5-tuxcare.22.11.5-tuxcare.3 |
2.11.5-tuxcare.4 |
webpack-dev-serverTuxCare:npm |
4.11.1-tuxcare.0 up to 4.11.1-tuxcare.3, plus listed versions 4.11.14.11.1-tuxcare.14.11.1-tuxcare.2 |
4.11.1-tuxcare.3 |
webpack-dev-serverTuxCare:npm |
5.2.2-tuxcare.0 up to 5.2.2-tuxcare.1, plus listed versions 5.2.2 |
5.2.2-tuxcare.1 |
webpack-dev-serverTuxCare:npm From an advisory covering 4 CVEs |
4.9.3-tuxcare.0 up to 4.9.3-tuxcare.1, plus listed versions 4.9.3 |
4.9.3-tuxcare.1 |
webpack-dev-serverTuxCare:npm From an advisory covering 2 CVEs |
5.2.5-tuxcare.0 up to 5.2.5-tuxcare.1, plus listed versions 5.2.5 |
5.2.5-tuxcare.1 |
webpack-dev-servernpm |
before 5.2.6 | 5.2.6 |
webpack-dev-serverRoot:npm |
before 5.2.2-aikido.3 | 5.2.2-aikido.35.2.3-aikido.35.0.4-aikido.25.2.4-aikido.23.11.3-aikido.4 |
@rootio/webpack-dev-serverRoot:npm |
before 5.2.2-root.io.3 | 5.2.2-root.io.35.2.3-root.io.35.0.4-root.io.25.2.4-root.io.23.11.3-root.io.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-14631 is a medium vulnerability (CVSS 5.3) in Webpack-dev-server, published July 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in webpack-dev-server 5.2.6.
References
github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj
cna.openjsf.org/security-advisories.html
nvd.nist.gov/vuln/detail/CVE-2026-14631