webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Published 17 Jun 2026 · Updated 10 Sept 2026
Affected package
- Affected
- <5.2.5
- Fixed in
- 5.2.5
npm install webpack-dev-server@5.2.5Details
Impact
When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches
Fixed in webpack-dev-server 5.2.5.
Workarounds
Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Is GHSA-mx8g-39q3-5c79 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected webpack-dev-server, and gives you the command that fixes it.
References
- Linkgithub.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-9595
- Linkgithub.com/facebook/create-react-app/pull/7444
- Linkgithub.com/webpack/webpack-dev-server/pull/4316
- Linkgithub.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb
- Linkcna.openjsf.org/security-advisories.html
- Packagegithub.com/webpack/webpack-dev-server
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.