CVE-2026-14631
Description
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
webpack-dev-servernpm | < 5.2.6 | 5.2.6 |
Affected products
3<=5.2.5+ 1 more
- (no CPE)range: <=5.2.5
- cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*range: <5.2.6
Patches
Vulnerability mechanics
References
6- cna.openjsf.org/security-advisories.htmlnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-m28w-2pqf-7qgjghsaADVISORY
- github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgjnvdMitigationVendor AdvisoryPatchWEB
- nvd.nist.gov/vuln/detail/CVE-2026-14631ghsaADVISORY
- github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489fghsaWEB
- github.com/webpack/webpack-dev-server/pull/5699ghsaWEB
News mentions
0No linked articles in our index yet.