webpack-dev-server CVE-2026-6402

Upgrade webpack-dev-server to version 5.2.4 or later immediately; this version sets the Cross-Origin-Resource-Policy: same-origin header on all responses, preventing cross-origin script loads. To upgrade, run 'npm update webpack-dev-server@^5.2.4' or 'npm install webpack-dev-server@5.2.4' in your project. Verify the upgrade by checking package.json and package-lock.json. For teams unable to upgrade immediately, implement compensating controls: (1) Run webpack-dev-server exclusively on localhost (127.0.0.1) and ensure it binds to the loopback interface only (configure host: 'localhost' or host: '127.0.0.1' in webpack.config.js); this prevents remote access but still allows local CSRF-style attacks if a developer visits a malicious site on the same machine. (2) Use HTTPS for the dev server (require https: true in webpack.config.js with a self-signed certificate); this enables Sec-Fetch-* headers even during development and partially mitigates the issue, though developers must accept browser warnings. (3) Restrict network access to the dev server port (e.g., iptables, firewall rules) to trusted IPs only. (4) Educate developers to avoid visiting untrusted websites during development sessions. These workarounds have trade-offs: localhost-only binding may impede remote development or CI/CD scenarios; HTTPS adds friction to dev workflows; firewall rules require infrastructure coordination. None are as robust as the patch. Patch application is strongly preferred.