Missing Origin Validation in webpack-dev-server

Description

Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer’s source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.

Recommendation

Update the webpack-dev-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.1.11
• Patched version(s): 3.1.11

References

• GHSA-cf66-xwfp-gvc4
• www.npmjs.com
• CVE-2018-14732
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins - CVE-2026-6402
• webpack-dev-server users' source code may be stolen when they access a malicious web site - CVE-2025-30359
• Missing Origin Validation in browserify-hmr - CVE-2018-14730
• webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browse - CVE-2025-30360

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

webpack-dev-server