CVE-2026-9595 Details
Description
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in [email protected]. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
A vulnerability exists in webpack-dev-server versions prior to 5.2.5, where a user-configured proxy with a broad context (such as '/') and WebSocket forwarding enabled intercepts the dev server's Hot Module Replacement (HMR) WebSocket. This interception forwards the HMR WebSocket to the proxy target, leaking the browser's cookies and Origin header to the backend. Additionally, it bypasses the dev server's Host and Origin validation, corrupts the HMR socket by causing both the HMR and proxy to write to the same socket, and disrupts the HMR functionality, particularly in Firefox.
Users can update to webpack-dev-server version 5.2.5 or later to address this vulnerability. If an immediate update is not possible, users can scope their proxy context to specific paths instead of using a broad context like '/' or omit the WebSocket forwarding option when it is not needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/facebook/create-react-app/pull/7444 | openjs | Issue TrackingPatch |
| https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb | openjs | Patch |
| https://github.com/webpack/webpack-dev-server/pull/4316 | openjs | Issue TrackingPatch |
| https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79 | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | openjs |
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | openjs |
Affected Products
| Product | Versions |
|---|---|
| webpack.js webpack-dev-server | < 5.2.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 15, 2026 | New CVE Received | openjs |