webpack-dev-server CVE-2026-9595

Exploitation requires two specific, co-occurring conditions in the webpack-dev-server proxy configuration: the proxy context must be set to / (or another path broad enough to prefix-match the HMR WebSocket path, typically /ws), AND ws: true must be present in the same proxy entry to enable WebSocket upgrade forwarding. Developers who scope their proxy to specific paths such as /api are not affected, as the HMR path /ws will not match the narrower context. Developers who omit ws: true from their proxy entry are also not affected, as no WebSocket upgrade forwarding occurs. Exploitation is further limited to development environments, since webpack-dev-server is not designed for production use. Once the misconfiguration is present, the leakage occurs automatically and passively whenever a browser connects and HMR initiates its WebSocket handshake - no additional attacker interaction is required beyond controlling or monitoring the configured proxy target backend.

The official CVSS base score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L captures only the availability dimension (HMR socket corruption) and is in direct tension with the CVE description, which explicitly identifies browser cookie leakage (confidentiality impact) and Host/Origin validation bypass (integrity impact). Security teams should treat the official CVSS as an understatement of actual impact. No CISA KEV listing or standalone POC is present in the source data, so active exploitation is unconfirmed. Risk is structurally bounded by the development-environment context - webpack-dev-server is not intended for production deployment, meaning real-world exposure is limited to developer workstations and CI environments. However, developer sessions may carry sensitive internal credentials or tokens that could be forwarded to an attacker-controlled backend if the proxy target is not fully trusted. The specific configuration prerequisite (context '/' with ws: true) is a common scaffolded default in many project templates, elevating the realistic exposure surface. Overall priority is moderate, elevated above the official score by the unacknowledged confidentiality and integrity impacts.

A developer runs webpack-dev-server with a proxy entry targeting an attacker-controlled or third-party backend using context '/' and ws: true - a common scaffolded configuration for full-stack development. When any browser tab opens the dev server and HMR initiates its WebSocket handshake to /ws, the upgrade handler silently forwards the request (including the browser's cookies and Origin header) to the backend proxy target instead of handling it internally. The backend receives the developer's session credentials, and the HMR channel is simultaneously corrupted, causing hot-reload to fail and potentially masking the credential leakage. No standalone POC is present in source data, but the vulnerability is trivially reproducible from the configuration described in the CVE.