SB2026051243 - Exposed dangerous method or function in webpack-dev-server

Description

This security bulletin contains information about 1 vulnerability.

1) Exposed dangerous method or function (CVE-ID: CVE-2026-6402)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper restriction of dangerous functionality in dev server JavaScript bundle access controls when handling cross-origin requests from malicious websites over a non-HTTPS origin. A remote attacker can load the dev server's JavaScript bundles and intercept the webpack runtime's module registration to disclose sensitive information.

User interaction is required to visit a malicious website, and exploitation requires knowledge of the dev server host, port, and output path.

Remediation

Install update from vendor's website.

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w
• https://github.com/advisories/GHSA-79cf-xcqc-c78w