Is webpack-dev-server 3.8 vulnerable?
npm · 3 releases from 3.8.0 to 3.8.2 · latest webpack-dev-server is 6.1.0 · checked 2 Nov 2026
Yes: 6 known advisories
Yes. webpack-dev-server 3.8.2, the last 3.8 release, is affected by 6 known security advisories (6 medium), including CVE-2026-14631, CVE-2026-14620, CVE-2026-9595. Upgrade to 5.2.6 or later to fix all of them.
npm install webpack-dev-server@5.2.6Advisories affecting webpack-dev-server 3.8.2
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
- Affected
- <5.2.6
- Fixed in
- 5.2.6
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
- Affected
- <5.2.6
- Fixed in
- 5.2.6
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
- Affected
- <5.2.5
- Fixed in
- 5.2.5
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
- Affected
- <5.2.4
- Fixed in
- 5.2.4
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
- Affected
- <5.2.1
- Fixed in
- 5.2.1
webpack-dev-server users' source code may be stolen when they access a malicious web site
- Affected
- <5.2.1
- Fixed in
- 5.2.1
Which of your client projects are still on webpack-dev-server 3.8?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact webpack-dev-server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other webpack-dev-server versions
- webpack-dev-server 3.11
- webpack-dev-server 3.10
- webpack-dev-server 3.9
- webpack-dev-server 3.7
- webpack-dev-server 3.6
- webpack-dev-server 3.5
- webpack-dev-server 6.1
- webpack-dev-server 6.0
- webpack-dev-server 5.2
- webpack-dev-server 5.1
- webpack-dev-server 5.0
- webpack-dev-server 4.15
- All webpack-dev-server advisories
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.