CVE-2026-114348 webpack-dev-server CVE debrief

Who should care

Defenders responsible for webpack-dev-server configurations and deployments should be aware of this vulnerability and take necessary actions to mitigate it. This includes upgrading to a patched version and monitoring for suspicious activity.

Why it matters

This vulnerability in webpack-dev-server allows for information disclosure via a Host validation bypass in the open-editor endpoint, affecting versions from 5.1.0 before 5.2.7 and version 6.0.0. Defenders should prioritize upgrading to a patched version and monitor for suspicious activity.

• Potential disclosure of sensitive information such as absolute filesystem paths, installed module locations, and internal source line numbers
• Possible exploitation by sending a request with a malformed Host header
• Need for verification of current configurations and monitoring for suspicious activity
• Priority on upgrading to a patched version of webpack-dev-server

Technical summary

The vulnerability in webpack-dev-server allows for information disclosure via a Host validation bypass in the open-editor endpoint. This issue affects versions from 5.1.0 before 5.2.7 and version 6.0.0. An attacker can exploit this vulnerability by sending a request with a malformed Host header, potentially disclosing absolute filesystem paths, installed module locations, and internal source line numbers in the server's error response.

Defensive priority

Defenders should prioritize upgrading to webpack-dev-server version 5.2.7 or 6.1.0, or later, to mitigate this vulnerability. They should also review their current configurations and monitor for any suspicious activity.

Recommended defensive actions

• Upgrade to webpack-dev-server version 5.2.7 or 6.1.0, or later
• Review and update configurations to prevent exploitation
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact and affected versions. However, there is limited information on potential exploits or attacks. Defenders should verify the current configurations, review module locations, and monitor for suspicious activity. The open-editor endpoint's Host validation bypass allows for information disclosure, potentially disclosing absolute filesystem paths, installed module locations, and internal source line numbers in the server's error response. webpack-dev-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.