Skip to main content

webpack-dev-server CVE-2026-14631

| EUVDEUVD-2026-41559 MEDIUM
Improper Input Validation (CWE-20)
2026-07-03 openjs GHSA-m28w-2pqf-7qgj
RCE Node.js Red Hat Webpack Dev Server Suse
5.3
CVSS 3.1 · Vendor: openjs
Share

Severity by source

Vendor (openjs) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
7.5 HIGH

Unauthenticated network exploitation with no complexity; A:H chosen over vendor A:L because a single packet terminates the entire Node.js process, constituting complete availability loss of the service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Patch available
Jul 03, 2026 - 19:01 EUVD
Analysis Generated
Jul 03, 2026 - 18:21 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 917 npm packages depend on webpack-dev-server (448 direct, 479 indirect)

Ecosystem-wide dependent count for version 5.2.6.

DescriptionCVE.org

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

AnalysisAI

webpack-dev-server 5.2.5 and earlier crash the entire Node.js host process when an unauthenticated remote peer sends either an HTTP request with a malformed Host header or a WebSocket upgrade to the /ws endpoint with a malformed Origin header. The malformed value bypasses graceful error handling in the host-validation path, triggering an uncaught exception that terminates the dev server process entirely. Impact is confined to availability - no confidentiality loss and no code execution occur despite a misleading 'RCE' tag in the source intelligence, which appears to be a mislabeling inconsistent with the vendor description and CVSS vector (C:N/I:N). No public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

webpack-dev-server is a Node.js-based development HTTP and WebSocket server bundled with the webpack build toolchain, widely used to serve JavaScript bundles with hot-module replacement during frontend development. The affected component is the host-validation middleware, which checks incoming Host (HTTP/1.1) and Origin (WebSocket upgrade) headers against an allowlist to prevent DNS rebinding attacks. CWE-20 (Improper Input Validation) is the root cause: the validation code does not guard against structurally malformed header values - values that are syntactically invalid rather than simply not on the allowlist - allowing a crafted input to reach a code path that throws an uncaught exception. In Node.js, an uncaught exception in the main event loop terminates the entire process, so a single malformed request is sufficient to crash the server. Affected CPE: cpe:2.3:a:webpack-dev-server:webpack-dev-server:*:*:*:*:*:*:*:* covering versions up to and including 5.2.5.

RemediationAI

The primary fix is to upgrade webpack-dev-server to version 5.2.6, which is the vendor-confirmed patched release per the GitHub Security Advisory GHSA-m28w-2pqf-7qgj (https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj). Run 'npm install webpack-dev-server@5.2.6 --save-dev' or 'yarn add webpack-dev-server@5.2.6 --dev' to update. For environments where an immediate upgrade is not possible, the vendor-recommended workaround is to ensure the dev server remains bound to localhost only (the default configuration), preventing untrusted network peers from reaching the vulnerable endpoint at all. If the dev server must be exposed on a non-loopback interface (e.g., in a shared CI runner or Docker container), restrict access via network-layer controls such as firewall rules or security group policies that allowlist only trusted source IPs to the dev server port. Note that binding to 0.0.0.0 without network controls is the primary misconfiguration that converts this from a theoretical to an exploitable issue.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-14631 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy