CVE-2026-14631
Description
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
How to fix
- webpack.js webpack-dev-server5.2.6 or later
- webpack-dev-server5.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webpack.js webpack-dev-server | v < 5.2.6 | 5.2.6 |
| webpack-dev-servernpm | v < 5.2.6 | 5.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.