PT-2026-55576 · Npm · Webpack-Dev-Server

Bjohansebas + 2 · Published 2026-07-03 · Updated 2026-07-03 · CVE-2026-14631

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.6

Description An unauthenticated peer can cause the Node.js process to terminate, resulting in a denial of service. This occurs when the server receives a normal HTTP request with a malformed Host header or a WebSocket upgrade request to the /ws endpoint with a malformed Origin header. The malformed values trigger an uncaught exception in the host-validation path, crashing the development server. The impact is limited to the availability of the server, with no risk of code execution or data disclosure.

Recommendations Upgrade to webpack-dev-server version 5.2.6. Keep the development server bound to localhost and avoid exposing it to untrusted networks.

Fix

DoS

RCE

Weakness Enumeration

CWE-248

CWE-20

Related Identifiers

CVE-2026-14631

Affected Products

Webpack-Dev-Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-14631 · Security Note
• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj · Note
• https://twitter.com/infoflowcloud/status/2073138615870230816 · Twitter Post
• https://cna.openjsf.org/security-advisories.html · Note
• https://twitter.com/CVEnew/status/2073136349394112972 · Twitter Post
• https://twitter.com/kom_256/status/2073096397054697728 · Twitter Post