CVE-2025-30360
Description
webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.
How to fix
- webpack.js webpack-dev-server5.2.1 or later
- webpack-dev-server5.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webpack.js webpack-dev-server | v < 5.2.1 | 5.2.1 |
| webpack-dev-servernpm | v < 5.2.1 | 5.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.