GHSA-mx8g-39q3-5c79

    Dashboard / Vulnerabilities / GHSA-mx8g-39q3-5c79

    GHSA-mx8g-39q3-5c79

    Published: 17 Jun 2026Last Modified: 10 Sept 2026
    Aliases:
    CVE-2026-9595

    Summary: webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

    Details: ### Impact When a user-configured proxy on `webpack-dev-server` has a broad context (e.g. `/`) and `ws: true`, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and `Origin` header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). ### Patches Fixed in `webpack-dev-server` 5.2.5. ### Workarounds Scope user-defined proxy `context` to specific paths instead of `/`, or omit `ws: true` from the proxy entry when WebSocket forwarding is not required.

    References: https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79, https://nvd.nist.gov/vuln/detail/CVE-2026-9595, https://github.com/facebook/create-react-app/pull/7444, https://github.com/webpack/webpack-dev-server/pull/4316, https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb, https://cna.openjsf.org/security-advisories.html, https://github.com/webpack/webpack-dev-server

    Affected packages

    Package

    Name: webpack-dev-server

    Purl: pkg:npm/webpack-dev-server

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -5.2.5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-mx8g-39q3-5c79 | CVE-DB