# webpack-dev-server (npm) vulnerabilities 7 known vulnerabilities (6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 6.1.0 (Oct 18, 2026): no advisory affects it - Newest unaffected release: 6.1.0 (Oct 18, 2026), the latest release - Weekly downloads: 21.6M - Dependents: 283 - Releases: 228 since 0.6.0 (Sep 18, 2012) - Registry: https://www.npmjs.com/package/webpack-dev-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-14631: 0.6.0 to 5.2.5 (5.2.6 is outside it) - CVE-2026-14620: 0.6.0 to 5.2.5 (5.2.6 is outside it) - CVE-2026-9595: 0.6.0 to 5.2.4 (5.2.5 is outside it) - CVE-2026-6402: 0.6.0 to 5.2.3 (5.2.4 is outside it) - CVE-2025-30360: 0.6.0 to 5.2.0 (5.2.1 is outside it) - CVE-2025-30359: 0.6.0 to 5.2.0 (5.2.1 is outside it) - CVE-2018-14732: 0.6.0 to 3.1.10 (3.1.11 is outside it) ## Advisories (7) ### [CVE-2026-14631](https://cve.now/CVE-2026-14631): webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header - Severity: Medium 5.3 - Published: Jul 3, 2026 - Affected: fixed in 5.2.6. - Fixed in 5.2.6 (released Jul 2, 2026, 1 day before disclosure). - The latest release, 6.1.0, is not affected. - 74% of webpack-dev-server downloads last week were affected versions (18.8M). ### [CVE-2026-14620](https://cve.now/CVE-2026-14620): webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints - Severity: Medium 4.7 - Published: Jul 3, 2026 - Affected: fixed in 5.2.6. - Fixed in 5.2.6 (released Jul 2, 2026, 1 day before disclosure). - The latest release, 6.1.0, is not affected. - 74% of webpack-dev-server downloads last week were affected versions (18.8M). ### [CVE-2026-9595](https://cve.now/CVE-2026-9595): webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies - Severity: Medium 5.3 - Published: Jun 15, 2026 - Affected: fixed in 5.2.5. - Fixed in 5.2.5 (released Jun 12, 2026, 3 days before disclosure). - The latest release, 6.1.0, is not affected. - 71% of webpack-dev-server downloads last week were affected versions (18.2M). ### [CVE-2026-6402](https://cve.now/CVE-2026-6402): webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins - Severity: Medium 5.3 - Published: May 12, 2026 - Affected: fixed in 5.2.4. - Fixed in 5.2.4 (released May 11, 2026, 1 day before disclosure). - The latest release, 6.1.0, is not affected. - 70% of webpack-dev-server downloads last week were affected versions (17.8M). ### [CVE-2025-30360](https://cve.now/CVE-2025-30360): webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser - Severity: Medium 6.5 - Published: Jun 3, 2025 - Affected: fixed in 5.2.1. - Fixed in 5.2.1 (released Mar 26, 2025, 69 days before disclosure). - The latest release, 6.1.0, is not affected. - 49% of webpack-dev-server downloads last week were affected versions (12.5M). ### [CVE-2025-30359](https://cve.now/CVE-2025-30359): webpack-dev-server users' source code may be stolen when they access a malicious web site - Severity: Medium 5.3 - Published: Jun 3, 2025 - Affected: fixed in 5.2.1. - Fixed in 5.2.1 (released Mar 26, 2025, 69 days before disclosure). - The latest release, 6.1.0, is not affected. - 49% of webpack-dev-server downloads last week were affected versions (12.5M). ### [CVE-2018-14732](https://cve.now/CVE-2018-14732): An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. - Severity: Unrated - Published: Sep 21, 2018 - Affected: fixed in 3.1.11. - Fixed in 3.1.11 (released Dec 21, 2018, 91 days after disclosure). - The latest release, 6.1.0, is not affected. - 1.6% of webpack-dev-server downloads last week were affected versions (401.9K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/webpack-dev-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.