Is webpack-dev-server 5.2 vulnerable?
npm · 8 releases from 5.2.0 to 5.2.7 · latest webpack-dev-server is 6.1.0 · checked 1 Nov 2026
No known advisories in the last release
webpack-dev-server 5.2.7, the last 5.2 release, has no known advisories. 6 advisories affect earlier 5.2.x releases, so update to 5.2.7.
npm install webpack-dev-server@5.2.7Fixed within 5.2.x, affecting earlier releases
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
- Affected
- <5.2.6
- Fixed in
- 5.2.6
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
- Affected
- <5.2.6
- Fixed in
- 5.2.6
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
- Affected
- <5.2.5
- Fixed in
- 5.2.5
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
- Affected
- <5.2.4
- Fixed in
- 5.2.4
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
- Affected
- <5.2.1
- Fixed in
- 5.2.1
webpack-dev-server users' source code may be stolen when they access a malicious web site
- Affected
- <5.2.1
- Fixed in
- 5.2.1
Which of your client projects are still on webpack-dev-server 5.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact webpack-dev-server version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other webpack-dev-server versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.