GHSA-mx8g-39q3-5c79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | webpack-dev-server | < 5.2.5 | 5.2.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When a user-configured proxy on `webpack-dev-server` has a broad context (e.g. `/`) and `ws: true`, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and `Origin` header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
### Patches
Fixed in `webpack-dev-server` 5.2.5.
### Workarounds
Scope user-defined proxy `context` to specific paths instead of `/`, or omit `ws: true` from the proxy entry when WebSocket forwarding is not required.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79
- https://nvd.nist.gov/vuln/detail/CVE-2026-9595
- https://github.com/facebook/create-react-app/pull/7444
- https://github.com/webpack/webpack-dev-server/pull/4316
- https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb
- https://cna.openjsf.org/security-advisories.html
- https://github.com/webpack/webpack-dev-server