MediumGHSA-79cf-xcqc-c78wCVE-2026-6402

webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

Published 18 May 2026 · Updated 10 Sept 2026

Affected package

Affected: <5.2.4
Fixed in: 5.2.4

Update to the fixed version for your release line, for example:npm install webpack-dev-server@5.2.4

Details

Impact

When webpack-dev-server is running on a non-HTTPS origin (the default), cross-origin requests from malicious websites can load the dev server's JavaScript bundles via <script> tags. The fix introduced in v5.2.1 (CVE-2025-30359) relied on Sec-Fetch-Mode and Sec-Fetch-Site request headers to block these requests, but browsers only send these headers for potentially trustworthy origins. Over plain HTTP, the headers are absent and the check is bypassed.

An attacker who knows the dev server's host, port, and output path can exfiltrate all module source code by intercepting the webpack runtime's module registration.

This does not affect Chrome 142+ (and other Chromium-based browsers) due to local network access restrictions.

Patches

Patched in webpack-dev-server >= 5.2.4 by setting Cross-Origin-Resource-Policy: same-origin on responses.

Workarounds

Run the dev server with HTTPS enabled (--https or server.type: 'https' in config).

Resources

GHSA-4v9v-hfq4-rm2v (CVE-2025-30359) - original vulnerability
GHSA-9jgg-88mc-972h (CVE-2025-30360) - prior bypass

Is GHSA-79cf-xcqc-c78w in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected webpack-dev-server, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.