CVE-2026-9595

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-9595
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://cna.openjsf.org/security-advisories.html Vendor Advisory
https://github.com/facebook/create-react-app/pull/7444 Issue Tracking Patch
https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb Patch
https://github.com/webpack/webpack-dev-server/pull/4316 Issue Tracking Patch
https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79 Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*
History

16 Jun 2026, 17:24

Type Values Removed Values Added
References () https://cna.openjsf.org/security-advisories.html - () https://cna.openjsf.org/security-advisories.html - Vendor Advisory
References () https://github.com/facebook/create-react-app/pull/7444 - () https://github.com/facebook/create-react-app/pull/7444 - Issue Tracking, Patch
References () https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb - () https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb - Patch
References () https://github.com/webpack/webpack-dev-server/pull/4316 - () https://github.com/webpack/webpack-dev-server/pull/4316 - Issue Tracking, Patch
References () https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79 - () https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79 - Mitigation, Vendor Advisory
CPE cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*
First Time Webpack.js webpack-dev-server
Webpack.js

15 Jun 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-15 16:16

Updated : 2026-06-16 17:24

NVD link : CVE-2026-9595

Mitre link : CVE-2026-9595

CVE.ORG link : CVE-2026-9595

JSON object : View

Products Affected

webpack.js

  • webpack-dev-server
CWE
CWE-346

Origin Validation Error

CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')