webpack-dev-server: Cross-origin WebSocket access via proxied upgrades
Summary
webpack-dev-server forwards non-HMR WebSocket upgrade requests to a configured proxy target without validating the Host or Origin headers, so allowedHosts does not apply to them. A malicious web page opened by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The attack requires a proxy entry with ws: true and that the developer visits the malicious page.
Affected
- webpack-dev-server versions before 5.2.7
- webpack-dev-server 6.0.0 up to but excluding 6.1.0
- Only configurations with a devServer.proxy entry that has ws: true are affected.
- Versions of the 4.x line: Unknown.
Fixed in
- Upgrade to webpack-dev-server 5.2.7 or 6.1.0 or later.
Workaround
- Remove ws: true from devServer.proxy entries where the proxied API does not need WebSocket forwarding.
- Limit proxy context to specific paths.
Exploitation
- No public proof of concept found.
- No evidence of exploitation in the wild found. KEV status: Unknown.
- EPSS score: 0.00147. CISA SSVC: Exploitation none, not automatable.
Our recommendation
- Find all webpack-dev-server copies in your projects, including transitive ones (e.g. npm ls webpack-dev-server).
- Upgrade to 5.2.7 or 6.1.0; move any 4.x copy to 5.x or later.
- Until upgraded, remove ws: true from proxy entries that do not need it.
- Do not run the dev server against production or shared backends from developer laptops.
- Developers should avoid browsing untrusted sites while a dev server with WebSocket proxies is running.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cfqc-fj3v-j925 github.com
- OpenJS CNA Security Advisories cna.openjsf.org
- webpack-dev-server release v5.2.7 github.com
- Ubuntu CVE-2026-112085 ubuntu.com
- Tenable CVE-2026-112085 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:13.
Original description (NVD)
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket, and users should upgrade to one of those versions or later. As a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.