GHSA-mx8g-39q3-5c79

Suggest an improvement
Source
https://github.com/advisories/GHSA-mx8g-39q3-5c79
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mx8g-39q3-5c79/GHSA-mx8g-39q3-5c79.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mx8g-39q3-5c79
Aliases
Downstream
Published
2026-06-17T18:13:31Z
Modified
2026-09-10T03:51:09Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Details

Impact

When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).

Patches

Fixed in webpack-dev-server 5.2.5.

Workarounds

Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

Database specific 
{
    "cwe_ids": [
        "CWE-346",
        "CWE-441"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-17T18:13:31Z",
    "nvd_published_at": "2026-06-15T16:16:35Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / webpack-dev-server

Package

Name
webpack-dev-server
View open source insights on deps.dev
Purl
pkg:npm/webpack-dev-server

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.2.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mx8g-39q3-5c79/GHSA-mx8g-39q3-5c79.json"