webpack-dev-server WebSocket proxy flaw exposes loopback to cross-origin attacks

A vulnerability in webpack-dev-server allows malicious web pages to interact with proxied backends. The flaw affects developers using versions before 5.2.7 and version 6.0.0, even when the server is bound to loopback.

What happened

The National Vulnerability Database records CVE-2026-112085 as a high-severity issue with a CVSS score of 8.2. According to the NVD record, webpack-dev-server is a tool that provides live reloading for webpack projects. The weakness stems from how the server handles WebSocket connections when a proxy entry is configured. Specifically, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating Host or Origin headers.

This behavior means the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can exploit this gap. The attacker can open a cross-origin WebSocket through the development server. This connection allows the attacker to read from and write to the proxied backend. The issue persists even if the development server is bound to loopback, which typically restricts access to the local machine.

The National Vulnerability Database identifies two Common Weakness Enumerations associated with this flaw: CWE-346 and CWE-1385. These classifications point to issues in data handling and protection mechanisms. The vulnerability exists in all versions of webpack-dev-server prior to 5.2.7. It also affects version 6.0.0. The specific combination of missing header validation and proxy forwarding creates the attack surface.

Why it matters

Developers often run webpack-dev-server on their local machines during the build process. The loopback binding is a common security assumption that prevents external access. However, this flaw bypasses that assumption through cross-origin requests initiated by a malicious website. If a developer visits a malicious site while the dev server is running, the attack can occur.

The ability to read and write to the proxied backend is significant. This access could expose sensitive data or allow command execution on the backend service. The NVD record notes that the issue is fixed in webpack-dev-server 5.2.7 and 6.1.0. In these patched versions, proxied WebSocket upgrades undergo the same Host and Origin validation as the HMR WebSocket. This alignment closes the gap in the allowedHosts protection.

Teams using version 6.0.0 are particularly exposed as it is a specific release with the flaw. Users of older versions before 5.2.7 are also at risk. The widespread use of webpack in modern web development means many environments may be affected. The ease of triggering the exploit via a simple web visit increases the likelihood of compromise.

Our take on the response

The vendor has provided clear patches for the affected versions. Upgrading to 5.2.7 or 6.1.0 resolves the validation bypass. For teams that cannot immediately upgrade, a workaround is available. According to the NVD record, users should omit WebSocket forwarding from proxy entries that do not need it. Additionally, scoping the proxy to specific paths can reduce exposure. This limits the surface area for potential attacks.

What TO DO:

• Upgrade webpack-dev-server to version 5.2.7 or 6.1.0.
• Remove WebSocket forwarding from proxy configurations if not required.
• Scope proxy entries to specific paths to limit exposure.
• Monitor for unauthorized WebSocket connections in development environments.

What defenders should look for

Teams should monitor for unusual WebSocket connections originating from development servers. Check logs for cross-origin requests that bypass standard host validation. Look for connections to proxied backends that do not match expected patterns. Analyze traffic for signs of data exfiltration or unauthorized writes. Ensure that allowedHosts protections are functioning correctly for all connection types. Review proxy configurations for unnecessary WebSocket forwarding. Contain potential breaches by isolating affected development environments. Verify that all instances are updated to patched versions. Watch for any anomalous activity in backend services connected to dev servers.

Background: Data exfiltration

Data exfiltration is the unauthorized transfer of information from a computer or network to an external recipient. It occurs when attackers move sensitive files, credentials, or databases out of your control. Understanding the methods helps you spot the subtle signs of data leaving your environment without triggering standard alarms.

Read the full guide: Data Exfiltration Explained: How Data Leaves Your Network

What to do and how to stay safe: webpack-dev-server

• Upgrade webpack-dev-server to version 5.2.7 or later.
• Upgrade webpack-dev-server to version 6.1.0 or later if using v6.
• Remove WebSocket forwarding from proxy entries that do not require it.
• Scope proxy configurations to specific paths to limit the attack surface.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of webpack-dev-server are affected by CVE-2026-112085?

All versions before 5.2.7 and version 6.0.0 are affected by this vulnerability.

Is there a fix available for this vulnerability?

Yes, the issue is fixed in webpack-dev-server 5.2.7 and 6.1.0.

Can this vulnerability be exploited if the server is bound to loopback?

Yes, the vulnerability allows exploitation even when the server is bound to loopback.