{"id":"CVE-2026-14631","aliases":["CLSA-2026-1784596297","CLSA-2026-1785204346","CLSA-2026-1786365627","CLSA-2026-1786365773","CLSA-2026-1787821986","CLSA-2026-1787823957","CLSA-2026-1787931162","CLSA-2026-1790604947","CLSA-2026-1790863106","EUVD-2026-41559","GHSA-m28w-2pqf-7qgj","ROOT-APP-NPM-CVE-2026-14631"],"status":"published","title":"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header","description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00517,"percentile":0.44426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-248"],"published":"2026-07-03T17:23:41Z","modified":"2026-11-05T13:28:21Z","fixes":[{"ecosystem":"npm","package":"webpack-dev-server","fixed_in":["5.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"webpack-dev-server","fixed_in":["4.11.1-tuxcare.3","5.2.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"webpack-dev-server","fixed_in":["5.2.2-aikido.3","5.2.3-aikido.3","5.0.4-aikido.2","5.2.4-aikido.2","3.11.3-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/webpack-dev-server","fixed_in":["5.2.2-root.io.3","5.2.3-root.io.3","5.0.4-root.io.2","5.2.4-root.io.2","3.11.3-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.5"},{"fixed":"5.2.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.15.2-tuxcare.0"},{"fixed":"4.15.2-tuxcare.2"}]}],"versions":["4.15.2","4.15.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-tuxcare.0"},{"fixed":"2.7.1-tuxcare.4"}]}],"versions":["2.7.1","2.7.1-tuxcare.1","2.7.1-tuxcare.2","2.7.1-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.15.1-tuxcare.0"},{"fixed":"4.15.1-tuxcare.4"}]}],"versions":["4.15.1","4.15.1-tuxcare.1","4.15.1-tuxcare.2","4.15.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-tuxcare.0"},{"fixed":"3.11.3-tuxcare.4"}]}],"versions":["3.11.3","3.11.3-tuxcare.1","3.11.3-tuxcare.2","3.11.3-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.5-tuxcare.0"},{"fixed":"2.11.5-tuxcare.4"}]}],"versions":["2.11.5","2.11.5-tuxcare.1","2.11.5-tuxcare.2","2.11.5-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.11.1-tuxcare.0"},{"fixed":"4.11.1-tuxcare.3"}]}],"versions":["4.11.1","4.11.1-tuxcare.1","4.11.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.2-tuxcare.0"},{"fixed":"5.2.2-tuxcare.1"}]}],"versions":["5.2.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.3-tuxcare.0"},{"fixed":"4.9.3-tuxcare.1"}]}],"versions":["4.9.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.5-tuxcare.0"},{"fixed":"5.2.5-tuxcare.1"}]}],"versions":["5.2.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"webpack-dev-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-aikido.3"},{"fixed":"5.2.3-aikido.3"},{"fixed":"5.0.4-aikido.2"},{"fixed":"5.2.4-aikido.2"},{"fixed":"3.11.3-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/webpack-dev-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-root.io.3"},{"fixed":"5.2.3-root.io.3"},{"fixed":"5.0.4-root.io.2"},{"fixed":"5.2.4-root.io.2"},{"fixed":"3.11.3-root.io.4"}]}]}],"products":[{"vendor":"webpack-dev-server","product":"webpack-dev-server"},{"vendor":"webpack.js","product":"webpack-dev-server"}],"references":[{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj","tags":["Mitigation","Vendor Advisory","Patch","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14631","tags":["advisory"]},{"url":"https://github.com/webpack/webpack-dev-server/pull/5699","tags":["web"]},{"url":"https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m28w-2pqf-7qgj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14631.json","tags":["advisory"]},{"url":"https://github.com/webpack/webpack-dev-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-14631","title":"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header","description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","status":"published","published":"2026-07-03T17:23:41.451Z","modified":"2026-07-06T15:54:11.285Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-41559","description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","status":"published","published":"2026-07-03T17:23:41Z","modified":"2026-07-06T15:54:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:13.172179Z"}],"ghsa":[{"id":"GHSA-m28w-2pqf-7qgj","title":"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header","description":"### Impact\n\nAn unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a normal HTTP request with a malformed `Host` header, or a WebSocket upgrade to the default `/ws` endpoint with a malformed `Origin` header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.\n\n### Patches\n\nFixed in `webpack-dev-server` 5.2.6 by treating malformed `Host` and `Origin` header values as invalid rather than throwing (see [PR #5699](https://github.com/webpack/webpack-dev-server/pull/5699)).\n\n### Workarounds\n\nKeep the dev server bound to `localhost` (the default) and do not expose it to untrusted networks.","status":"published","published":"2026-07-20T22:02:31Z","modified":"2026-07-20T22:02:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T14:40:48.410776Z"}],"nvd":[{"id":"CVE-2026-14631","description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","status":"published","published":"2026-07-03T18:16:24.687Z","modified":"2026-07-07T15:08:59.667Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T14:12:27.541515Z"}],"osv":[{"id":"CVE-2026-14631","title":"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header","description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","status":"published","published":"2026-07-03T17:23:41.451Z","modified":"2026-10-28T02:31:08.97391754Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"GHSA-m28w-2pqf-7qgj","title":"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header","description":"### Impact\n\nAn unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a normal HTTP request with a malformed `Host` header, or a WebSocket upgrade to the default `/ws` endpoint with a malformed `Origin` header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.\n\n### Patches\n\nFixed in `webpack-dev-server` 5.2.6 by treating malformed `Host` and `Origin` header values as invalid rather than throwing (see [PR #5699](https://github.com/webpack/webpack-dev-server/pull/5699)).\n\n### Workarounds\n\nKeep the dev server bound to `localhost` (the default) and do not expose it to untrusted networks.","status":"published","published":"2026-07-20T22:02:31Z","modified":"2026-09-10T03:50:52.455906127Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20","CWE-248"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"CLSA-2026-1784596297","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:52.668060265Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785204346","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.7.1-tuxcare.4.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.826281487Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1786365627","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.1-tuxcare.4.","status":"published","published":"2026-08-10T12:40:27Z","modified":"2026-10-15T09:46:00.824286509Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786365773","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 3.11.3-tuxcare.4.","status":"published","published":"2026-08-10T12:42:53Z","modified":"2026-11-05T13:28:21.916037226Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1787821986","title":"TuxCare security update for webpack-dev-server (3 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4.","status":"published","published":"2026-08-27T09:13:06Z","modified":"2026-10-15T09:48:03.099814515Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787823957","title":"TuxCare security update for webpack-dev-server (1 CVE)","description":"TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.1-tuxcare.3.","status":"published","published":"2026-08-27T09:45:57Z","modified":"2026-10-15T09:48:03.132940889Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787931162","title":"TuxCare security update for webpack-dev-server (1 CVE)","description":"TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 5.2.2-tuxcare.1.","status":"published","published":"2026-08-28T15:32:42Z","modified":"2026-10-15T09:47:55.365099964Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790604947","title":"TuxCare security update for webpack-dev-server (4 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 4.9.3-tuxcare.1.","status":"published","published":"2026-09-28T14:15:47Z","modified":"2026-10-15T09:48:04.017954079Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790863106","title":"TuxCare security update for webpack-dev-server (2 CVEs)","description":"TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 5.2.5-tuxcare.1.","status":"published","published":"2026-10-01T13:58:26Z","modified":"2026-10-15T09:48:04.062427657Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"ROOT-APP-NPM-CVE-2026-14631","title":"CVE-2026-14631 in webpack-dev-server - Patched by Root","description":"Root has patched CVE-2026-14631 in the webpack-dev-server package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-21T12:18:20Z","modified":"2026-08-21T13:45:05.921630778Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}