CVE-2026-112085

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.7 webpack-dev-server version 6.0.0

Description When a proxy entry is configured to forward WebSockets, the server forwards non-HMR (Hot Module Replacement) WebSocket upgrade requests to the proxy target without validating the Host or Origin headers. This bypasses the allowedHosts protection. Consequently, a malicious web page visited by a developer can establish a cross-origin WebSocket connection through the development server to read from and write to the proxied backend, even if the server is bound to the loopback address.

Recommendations Update to version 5.2.7 or later. Update to version 6.1.0 or later. Omit WebSocket forwarding from proxy entries that do not require it and scope the proxy to specific paths.