SB20261109158 - Multiple vulnerabilities in webpack-dev-server

Description

This security bulletin contains information about 2 vulnerabilities.

1) Information Exposure Through an Error Message (CVE-ID: CVE-2026-114348)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to obtain absolute filesystem paths and internal source locations from a reachable webpack-dev-server.

The vulnerability exists due to incorrect Host validation in the /webpack-dev-server/open-editor endpoint that accepts malformed headers beginning with file:. An unauthenticated remote attacker can send a crafted request to bypass host restrictions and trigger an exception whose stack trace is exposed in the default non-production mode.

2) Missing Origin Validation in WebSockets (CVE-ID: CVE-2026-112085)

CWE-ID: CWE-1385 - Missing Origin Validation in WebSockets

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to read from and write to a backend proxied through webpack-dev-server.

The vulnerability exists due to missing Host and Origin validation for WebSocket upgrade requests when a devServer.proxy entry has ws set to true. An unauthenticated remote attacker can lure a developer into visiting a malicious page that opens a cross-origin WebSocket through the dev server to the backend, even when the server is bound to loopback.

Remediation

Install update from vendor's website.

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-wqhc-fvfg-56q6
• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-cfqc-fj3v-j925