GHSA-m28w-2pqf-7qgj

An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.

Patches

Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #5699).

Workarounds

Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

Database specific

{
    "severity": "MODERATE",
    "nvd_published_at": "2026-07-03T18:16:24Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20",
        "CWE-248"
    ],
    "github_reviewed_at": "2026-07-20T22:02:31Z"
}

References

Affected packages

npm / webpack-dev-server

Package

Name: webpack-dev-server; View open source insights on deps.dev
Purl: pkg:npm/webpack-dev-server

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.2.6

Database specific

last_known_affected_version_range

"<= 5.2.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-m28w-2pqf-7qgj/GHSA-m28w-2pqf-7qgj.json"