CVE-2026-14631: falha de média gravidade em webpack-dev-server
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
webpack-dev-server · webpack-dev-serverCVEs relacionadas — webpack-dev-server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-14620MEDIUMwebpack-dev-server vulnerable to cross-site request forgery via internal developer endpointsEPSS 0.5%CVE-2026-114348MEDIUMwebpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpointEPSS 0.3%CVE-2026-6402MEDIUMwebpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originsEPSS 0.3%CVE-2026-9595MEDIUMwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxiesEPSS 0.2%CVE-2026-112085HIGHwebpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradesEPSS 0.1%