Missing Origin Validation in WebSockets in webpack-dev-server - CVE-2026-112085
Published: November 9, 2026
Vulnerability identifier: #VU162929
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-112085
CWE-ID: CWE-1385
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read from and write to a backend proxied through webpack-dev-server.
The vulnerability exists due to missing Host and Origin validation for WebSocket upgrade requests when a devServer.proxy entry has ws set to true. An unauthenticated remote attacker can lure a developer into visiting a malicious page that opens a cross-origin WebSocket through the dev server to the backend, even when the server is bound to loopback.
Affected software
webpack-dev-server
How to mitigate CVE-2026-112085
Install security update from vendor's website.
webpack-dev-server - addressed in versions 5.2.7, 6.1.0