CVE-2026-6402 Details
Description
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.
A vulnerability in webpack-dev-server in versions through 5.2.3 allows for cross-origin exposure of source code when served over non-HTTPS origins, such as plain HTTP. The issue arises because the server's JavaScript bundles can be loaded by malicious websites as scripts, bypassing previous security measures that relied on request headers not sent by browsers for untrusted origins. This vulnerability enables an attacker to intercept and exfiltrate application source code from developers using the dev server over HTTP on a guessable host and port. However, this issue does not affect Chromium-based browsers from Chrome 142 onward due to local network access restrictions.
Users can upgrade to webpack-dev-server version 5.2.4 or later, which addresses the vulnerability by setting the Cross-Origin-Resource-Policy header to same-origin on responses. Alternatively, the dev server can be run with HTTPS enabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | openjs |
Affected Products
| Product | Versions |
|---|---|
| webpack.js webpack-dev-server | < 5.2.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | New CVE Received | openjs |