webpack-dev-server CVE-2026-9595

webpack-dev-server (CPE: cpe:2.3:a:webpack-dev-server:webpack-dev-server:*:*:*:*:*:*:*:*) is a Node.js development HTTP server providing Hot Module Replacement (HMR) via a persistent WebSocket connection on a configurable path (defaulting to /ws). HTTP-to-WebSocket upgrades are handled by listening to the 'upgrade' event on the underlying Node.js HTTP server. Pre-fix, the proxy integration registered a generic upgrade handler (proxyUpgrade) that processed all incoming upgrade requests without first checking whether the request URL matched the internal HMR WebSocket path. When a developer configures a proxy entry with context '/' and ws: true, this handler captures HMR upgrade requests and forwards them to the external proxy target. The root cause is CWE-346 (Origin Validation Error): the server failed to maintain proper separation between its own internal WebSocket endpoint and developer-configured proxy WebSocket forwarding. The fix in PR #4316 adds an explicit pathname guard - extracting the configured HMR path and returning early from the upgrade handler if the incoming request URL matches it. Equivalent mitigations were applied in downstream toolchains: Vue CLI (commit 72ba7505) and create-react-app (PR #7444) both patched their proxy helpers to exclude the HMR sockjs-node endpoint from broad proxy matching, confirming this anti-pattern spanned the wider webpack ecosystem.