CVE-2026-112085 webpack-dev-server CVE debrief

Who should care

Defenders responsible for webpack-dev-server installations, particularly those using versions before 5.2.7 or 6.0.0, should assess exposure and prioritize upgrading to a fixed version.

Why it matters

Defenders should care about CVE-2026-112085 because it allows cross-origin WebSocket access via proxied upgrades in webpack-dev-server, potentially enabling malicious web pages to interact with the proxied backend.

• A malicious web page can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend.
• The allowedHosts protection does not apply to proxied upgrades.
• Defenders should verify the Host and Origin headers for proxied WebSocket upgrades.
• Remediation priority is high for environments using affected versions.

Technical summary

The vulnerability exists in webpack-dev-server versions before 5.2.7 and in version 6.0.0. When a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket.

Defensive priority

Defenders should prioritize upgrading to webpack-dev-server 5.2.7 or 6.1.0, or later, and omit WebSocket forwarding from proxy entries that do not need it.

Recommended defensive actions

• Upgrade to webpack-dev-server 5.2.7 or 6.1.0, or later
• Omit WebSocket forwarding from proxy entries that do not need it
• Scope the proxy to specific paths
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and fixed versions. webpack-dev-server versions before 5.2.7 and version 6.0.0 are vulnerable. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0. Users should verify the Host and Origin headers for proxied WebSocket upgrades. The allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.