CVE-2026-9595
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches: Fixed in [email protected].
Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches: Fixed in [email protected].
Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
- Record
CVE-2026-9595- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-346, CWE-441
- Updated
- 2026-11-02
EUVDEUVD-2026-36729
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches: Fixed in [email protected].
Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
- Record
EUVD-2026-36729- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mx8g-39q3-5c79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Impact
When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches
Fixed in webpack-dev-server 5.2.5.
Workarounds
Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
- Record
GHSA-mx8g-39q3-5c79- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-346, CWE-441
- Updated
- 2026-11-02
NVD
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches: Fixed in [email protected].
Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
- Record
CVE-2026-9595- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-346, CWE-441
- Updated
- 2026-11-02
OSV
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches: Fixed in [email protected].
Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
- Record
CVE-2026-9595- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-346, CWE-441
- Updated
- 2026-11-02
OSVGHSA-mx8g-39q3-5c79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Impact
When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches
Fixed in webpack-dev-server 5.2.5.
Workarounds
Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
- Record
GHSA-mx8g-39q3-5c79- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-346, CWE-441
- Updated
- 2026-11-02
Show 11 moreShow less
OSVRHSA-2026:57590
Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update
- Record
RHSA-2026:57590- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-9595
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in [email protected]. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
- Record
UBUNTU-CVE-2026-9595- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1774311630 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.15.1-tuxcare.1.
- Record
CLSA-2026-1774311630- Updated
- 2026-11-02
OSVCLSA-2026-1785204346 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.7.1-tuxcare.4.
- Record
CLSA-2026-1785204346- Updated
- 2026-11-02
OSVCLSA-2026-1786365773 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 3.11.3-tuxcare.4.
- Record
CLSA-2026-1786365773- Updated
- 2026-11-05
OSVCLSA-2026-1787821986 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4.
- Record
CLSA-2026-1787821986- Updated
- 2026-11-02
OSVCLSA-2026-1787837465 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4.
- Record
CLSA-2026-1787837465- Updated
- 2026-11-02
OSVCLSA-2026-1787837620 No score
TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.2-tuxcare.3.
- Record
CLSA-2026-1787837620- Updated
- 2026-11-02
OSVCLSA-2026-1790004677 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2.
- Record
CLSA-2026-1790004677- Updated
- 2026-11-02
OSVCLSA-2026-1790604947 No score
TuxCare security update for webpack-dev-server (4 CVEs)
TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 4.9.3-tuxcare.1.
- Record
CLSA-2026-1790604947- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-9595 No score
CVE-2026-9595 in webpack-dev-server - Patched by Root
Root has patched CVE-2026-9595 in the webpack-dev-server package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-9595- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webpack-dev-servernpm |
before 5.2.5 | 5.2.5 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
4.15.1-tuxcare.0 up to 4.15.1-tuxcare.1, plus listed versions 4.15.1 |
4.15.1-tuxcare.1 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
2.7.1-tuxcare.0 up to 2.7.1-tuxcare.4, plus listed versions 2.7.12.7.1-tuxcare.12.7.1-tuxcare.22.7.1-tuxcare.3 |
2.7.1-tuxcare.4 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
3.11.3-tuxcare.0 up to 3.11.3-tuxcare.4, plus listed versions 3.11.33.11.3-tuxcare.13.11.3-tuxcare.23.11.3-tuxcare.3 |
3.11.3-tuxcare.4 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
2.11.5-tuxcare.0 up to 2.11.5-tuxcare.4, plus listed versions 2.11.52.11.5-tuxcare.12.11.5-tuxcare.22.11.5-tuxcare.3 |
2.11.5-tuxcare.4 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
4.11.1-tuxcare.0 up to 4.11.1-tuxcare.4, plus listed versions 4.11.14.11.1-tuxcare.14.11.1-tuxcare.24.11.1-tuxcare.3 |
4.11.1-tuxcare.4 |
webpack-dev-serverTuxCare:npm |
4.15.2-tuxcare.0 up to 4.15.2-tuxcare.3, plus listed versions 4.15.24.15.2-tuxcare.14.15.2-tuxcare.2 |
4.15.2-tuxcare.3 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
5.2.2-tuxcare.0 up to 5.2.2-tuxcare.2, plus listed versions 5.2.25.2.2-tuxcare.1 |
5.2.2-tuxcare.2 |
webpack-dev-serverTuxCare:npm From an advisory covering 4 CVEs |
4.9.3-tuxcare.0 up to 4.9.3-tuxcare.1, plus listed versions 4.9.3 |
4.9.3-tuxcare.1 |
rh-podman-desktopRed Hat:enterprise_linux:10.2 From an advisory covering 24 CVEs |
before 0:1.1.2-1.el10_2 | 0:1.1.2-1.el10_2 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
webpack-dev-serverRoot:npm |
before 4.10.0-aikido.2 | 4.10.0-aikido.23.11.3-aikido.35.0.4-aikido.15.2.4-aikido.15.2.2-aikido.25.2.3-aikido.25.2.2-aikido.35.2.3-aikido.35.0.4-aikido.25.2.4-aikido.23.11.3-aikido.44.10.0-aikido.3 |
@rootio/webpack-dev-serverRoot:npm |
before 4.10.0-root.io.2 | 4.10.0-root.io.23.11.3-root.io.35.0.4-root.io.15.2.4-root.io.15.2.2-root.io.25.2.3-root.io.25.2.2-root.io.35.2.3-root.io.35.0.4-root.io.25.2.4-root.io.23.11.3-root.io.44.10.0-root.io.3 |
node-webpackUbuntu:18.04:LTS |
All versions, plus listed versions 3.5.6-1build33.5.6-1build43.5.6-2 |
None known |
node-webpackUbuntu:20.04:LTS |
All versions, plus listed versions 4.7.0-34.30.0-74.30.0-9 |
None known |
vue.jsUbuntu:20.04:LTS |
All versions, plus listed versions 2.5.17+dfsg-4 |
None known |
node-webpackUbuntu:22.04:LTS |
All versions, plus listed versions 4.43.0-6build44.43.0-7 |
None known |
vue.jsUbuntu:22.04:LTS |
All versions, plus listed versions 2.6.12+dfsg-32.6.14+dfsg-12.6.14+dfsg-2 |
None known |
node-webpackUbuntu:24.04:LTS |
All versions, plus listed versions 5.76.1+dfsg1+~cs17.16.16-1 |
None known |
vue.jsUbuntu:24.04:LTS |
All versions, plus listed versions 2.6.14+dfsg1-1 |
None known |
node-webpackUbuntu:25.10 |
All versions, plus listed versions 5.97.1+dfsg1+~cs11.18.27-25.97.1+dfsg1+~cs11.18.27-3 |
None known |
vue.jsUbuntu:25.10 |
All versions, plus listed versions 2.6.14+dfsg1-1 |
None known |
node-webpackUbuntu:26.10 |
All versions, plus listed versions 5.105.4+dfsg1+~cs15.13.23-25.108.0+dfsg1+~cs14.7.20-2 |
None known |
vue.jsUbuntu:26.10 |
All versions, plus listed versions 2.6.14+dfsg1-32.7.16+dfsg1-3 |
None known |
node-webpackUbuntu:26.04:LTS |
All versions, plus listed versions 5.97.1+dfsg1+~cs11.18.27-35.97.1+dfsg1+~cs11.18.27-45.105.4+dfsg1+~cs15.13.23-2 |
None known |
vue.jsUbuntu:26.04:LTS |
All versions, plus listed versions 2.6.14+dfsg1-12.6.14+dfsg1-1build12.6.14+dfsg1-22.6.14+dfsg1-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-9595 is a medium vulnerability (CVSS 5.3) in Webpack-dev-server, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in webpack-dev-server 5.2.5.
References
github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79
cna.openjsf.org/security-advisories.html
nvd.nist.gov/vuln/detail/CVE-2026-9595
Show 167 moreShow less
access.redhat.com/errata/RHSA-2026:57590
bugzilla.redhat.com/show_bug.cgi?id=2455470
issues.redhat.com/browse/RHEL-238929
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json
cve.org/CVERecord?id=CVE-2026-9595
cwe.mitre.org/data/definitions/93.html
html.spec.whatwg.org/multipage/form-control-infrastructure.html
npmjs.com/package/form-data
pkg.go.dev/github.com/go-jose/go-jose/v4
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json
ubuntu.com/security/CVE-2026-9595