webpack-dev-server CVE-2026-14631

The vulnerable host-validation code path is reachable only when the webpack-dev-server is exposed on a network interface accessible to the attacker - specifically, when it is NOT bound exclusively to localhost (127.0.0.1 or ::1). The default webpack-dev-server configuration binds to localhost only, which is a strong limiting factor: the vast majority of developer workstation deployments are not exploitable without deliberate misconfiguration. Exploitation requires: (1) the dev server configured with host '0.0.0.0', a LAN IP, or any non-loopback bind address, or (2) the attacker having local network access to the development machine. Two distinct trigger paths exist - a malformed Host header on any HTTP request, or a malformed Origin header on a WebSocket upgrade to the default /ws endpoint. No authentication is required once network reach is established. Exploitation does not require any specific webpack project configuration beyond running the affected server version on an exposed interface. What limits real-world impact: this is a development tool not intended for production, default configuration prevents remote access, and the impact is confined to crashing the dev process with no data or code execution consequence.

Real-world risk is low-to-moderate despite the CVSS 5.3 (Medium) score. The CVSS vector AV:N/AC:L/PR:N/UI:N correctly reflects that no authentication or user interaction is needed and exploitation is trivially automated, but the A:L rating (partial availability) is arguably understated - the vulnerability terminates the entire Node.js process, which more closely aligns with A:H; this discrepancy between the vendor-assigned score and the technical outcome should be verified. The provided 'RCE' tag in the intelligence feed directly contradicts the vendor description and CVSS C:N/I:N metrics; this tag is almost certainly erroneous and should not influence risk scoring. Critically, the default webpack-dev-server configuration binds only to localhost (127.0.0.1), which means the attack surface is zero in typical developer workstation deployments. Risk materializes primarily in CI/CD pipeline runners, shared development environments, or containerized setups where the dev server is inadvertently exposed on 0.0.0.0 or a routable interface. No EPSS data was provided; no CISA KEV listing exists; no POC was referenced. The practical threat is a nuisance DoS of a development tool, not a production-system compromise.

An attacker with network access to an exposed webpack-dev-server instance (e.g., a CI runner or developer workstation with the server bound to 0.0.0.0) sends a single HTTP GET request with a structurally invalid Host header value such as a null byte or malformed unicode sequence. The host-validation path throws an uncaught exception, and Node.js terminates the dev server process immediately, halting all active development builds and hot-module replacement sessions. No public exploit code was referenced in available intelligence, but the attack is trivially constructable from the description.