CVE-2026-9595

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.5

Description A permissive user-configured proxy with a broad context (e.g., '/') and ws: true intercepts the development server's own Hot Module Replacement (HMR) WebSocket and forwards it to the proxy target. This results in the leakage of the browser's cookies and Origin header to the backend and bypasses the development server's Host/Origin validation. Additionally, this causes corruption of the HMR socket as both the HMR and the proxy attempt to write to the same socket.

Recommendations Update to version 5.2.5. Scope user-defined proxy context to specific paths instead of '/'. Omit ws: true from the proxy entry when WebSocket forwarding is not required.