CVE-2026-9595
Description
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in [email protected]. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
How to fix
- webpack.js webpack-dev-server5.2.5 or later
- webpack-dev-server5.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webpack.js webpack-dev-server | v < 5.2.5 | 5.2.5 |
| webpack-dev-servernpm | v < 5.2.5 | 5.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.