webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Published 20 Jul 2026 · Updated 10 Sept 2026
Affected package
- Affected
- <5.2.6
- Fixed in
- 5.2.6
npm install webpack-dev-server@5.2.6Details
Impact
An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.
Patches
Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #5699).
Workarounds
Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Is GHSA-m28w-2pqf-7qgj in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected webpack-dev-server, and gives you the command that fixes it.
References
- Linkgithub.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-14631
- Linkgithub.com/webpack/webpack-dev-server/pull/5699
- Linkgithub.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f
- Linkcna.openjsf.org/security-advisories.html
- Packagegithub.com/webpack/webpack-dev-server
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.