5.3
CVE-2026-14631
- EPSS 0.31%
- Veröffentlicht 03.07.2026 17:23:41
- Zuletzt bearbeitet 07.07.2026 15:08:59
- Quelle ce714d77-add3-4f53-aff5-83d477
- CVE-Watchlists
- Unerledigt
Loginwebpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Webpack.Js ≫ Webpack-dev-server Version < 5.2.6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.31% | 0.226 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| ce714d77-add3-4f53-aff5-83d477b104bb | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-248 Uncaught Exception
An exception is thrown from a function, but it is not caught.
https://cna.openjsf.org/security-advisories.html
https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj