Is webpack-dev-server 2.7 vulnerable?
npm · 1 release from 2.7.1 to 2.7.1 · latest webpack-dev-server is 6.1.0 · checked 2 Nov 2026
Yes: 7 known advisories
Yes. webpack-dev-server 2.7.1, the last 2.7 release, is affected by 7 known security advisories (1 high, 6 medium), including CVE-2018-14732, CVE-2026-14631, CVE-2026-14620. Upgrade to 5.2.6 or later to fix all of them.
npm install webpack-dev-server@5.2.6Advisories affecting webpack-dev-server 2.7.1
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
- Affected
- <5.2.6
- Fixed in
- 5.2.6
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
- Affected
- <5.2.6
- Fixed in
- 5.2.6
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
- Affected
- <5.2.5
- Fixed in
- 5.2.5
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
- Affected
- <5.2.4
- Fixed in
- 5.2.4
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
- Affected
- <5.2.1
- Fixed in
- 5.2.1
webpack-dev-server users' source code may be stolen when they access a malicious web site
- Affected
- <5.2.1
- Fixed in
- 5.2.1
Missing Origin Validation in webpack-dev-server
- Affected
- <3.1.11
- Fixed in
- 3.1.11
Which of your client projects are still on webpack-dev-server 2.7?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact webpack-dev-server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other webpack-dev-server versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.