CVE-2026-114348

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions 5.1.0 through 5.2.6 webpack-dev-server version 6.0.0

Description The unauthenticated 'open-editor' endpoint validates the Host header using a regular expression designed for browser Origin schemes. A Host value starting with file: or an extension scheme can bypass the hostname and allowedHosts checks. A network peer can send a request with a malformed Host that passes validation, causing the endpoint's URL construction to fail. In default non-production mode, the server returns an HTTP 500 response containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers.

Recommendations Update versions 5.1.0 through 5.2.6 to 5.2.7 or later. Update version 6.0.0 to 6.1.0 or later.