CVE-2026-14631 is a denial of service vulnerability in webpack-dev-server versions 5.2.5 and earlier. An unauthenticated peer can cause the server to crash by sending a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The impact is limited to availability of the development server, with no data disclosure or code execution. [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-03T17:16:53.620Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects webpack-dev-server versions 5.2.5 and earlier, exposing internal developer endpoints that can be triggered cross-origin without interaction. An attacker can open arbitrary local fil [truncated]
CVE-2026-9595 is a security vulnerability in webpack-dev-server that allows an attacker to bypass security features and leak sensitive information. When a user-configured proxy on webpack-dev-server has a broad context (e.g., /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasse [truncated]
