CVE-2018-14732: Missing Origin Validation in webpack-dev-server
Summary
CVE-2018-14732: Missing Origin Validation in webpack-dev-server. Affects webpack-dev-server versions < 3.1.11. Fixed in 3.1.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The webpack-dev-server is a development server that provides live reloading and hot module replacement (HMR) capabilities for webpack. It allows developers to quickly test and iterate on their code during the development process. However, versions of webpack-dev-server before 3.1.10 are vulnerable to a missing origin validation issue on the websocket server used for HMR.
Vulnerability Detail
The missing origin validation vulnerability in webpack-dev-server allows a remote attacker to steal a developer's source code. This occurs because the origin of requests to the websocket server used for HMR is not properly validated. By exploiting this vulnerability, an attacker can send malicious requests to the websocket server and gain unauthorized access to the developer's source code. This can lead to the exposure of sensitive information and potential compromise of the entire application.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install webpack-dev-server@6.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.11
This is the first release that contains the fix.
npm install webpack-dev-server@3.1.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability other than updating to the fixed version of webpack-dev-server.
Conclusion
The missing origin validation vulnerability in webpack-dev-server can lead to the theft of a developer's source code and potential compromise of the entire application. It is crucial to update to version 3.1.11 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for webpack-dev-server →
FAQ
webpack-dev-server is a development server that provides live reloading and hot module replacement capabilities for webpack. It allows developers to test and iterate on their code during the development process.
This vulnerability allows a remote attacker to steal a developer's source code, potentially exposing sensitive information and compromising the entire application.
To fix this vulnerability, update webpack-dev-server to version 3.1.11 or later.
There are no known workarounds for this vulnerability other than updating to the fixed version of webpack-dev-server.
You can find more information about this vulnerability in the advisory on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-cf66-xwfp-gvc4/GHSA-cf66-xwfp-gvc4.json
References
Related vulnerabilities
Recent vulnerabilities recorded for webpack-dev-server.
