webpack-dev-server EUVD-2026-108109

Requires that the webpack-dev-server /webpack-dev-server/open-editor endpoint (registered unauthenticated by default) be network-reachable by the attacker, and that the server run in its default non-production mode, which returns full exception stack traces in HTTP 500 bodies. The concrete trigger is a request whose Host header begins with 'file:' or '<something>-extension:' (e.g. 'file:badport'), which short-circuits the Origin-scheme regex before the hostname and allowedHosts checks run. Limiting factors: this is a development server, so exploitation requires the dev server to be bound beyond localhost (reachable by a network peer); configurations running in production mode would not emit the stack-trace body; affected versions are 5.1.0-5.2.6 and 6.0.0 only.

This is a genuinely moderate issue whose signals are internally consistent: CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw with confidentiality-only impact (C:L, I:N, A:N), which matches CWE-209 (information exposure through an error message). The vuln.today Decision label is 'this_month' - a patch-this-cycle priority, not act_now or emergency - and that aligns with the limited impact: the advisory confirms there is no denial of service and no code execution, only disclosure of absolute filesystem paths, installed module locations, and source line numbers via a 500 stack trace. No EPSS score, no CISA KEV listing, and no SSVC/automatable fields were supplied, and no proof-of-concept or exploit reference appears in the input, so exploitation probability cannot be quantified from the data. Note the tension between the metadata and the primary source: the input Tags include 'Denial Of Service', but the GHSA advisory and the CVE description both state explicitly that the server keeps running and there is no DoS - treat the DoS tag as incorrect. The practical risk is further bounded by exposure: webpack-dev-server is a development tool, so real risk depends on whether the dev server is reachable beyond localhost. This is a real priority to patch but not a high-urgency, widely-weaponized threat.

A development server is reachable by another host on the local or corporate network (not bound solely to loopback). The attacker sends an unauthenticated HTTP request to /webpack-dev-server/open-editor with a malformed Host header such as 'file:badport'; the Origin-style regex short-circuits the hostname and allowedHosts checks, URL construction then throws, and the default non-production error handler returns a 500 whose body leaks absolute filesystem paths, installed module locations, and internal source line numbers for reconnaissance. No public exploit was identified in the provided data, and low attack complexity (AC:L) means no special timing or grooming is needed.