CVE-2026-14631: webpack-dev-server Denial of Service via Malformed Host or Origin Header
Summary
CVE-2026-14631: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header. Affects webpack-dev-server versions < 5.2.6. Fixed in 5.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
webpack-dev-server is a popular development server for serving JavaScript applications, particularly those built with Webpack. It provides features such as live reloading and hot module replacement, making it an essential tool for developers. However, it is vulnerable to a denial of service attack when exposed to malformed Host or Origin headers, which can crash the server.
Vulnerability Detail
The vulnerability arises when an unauthenticated peer sends a malformed Host header in a normal HTTP request or a malformed Origin header during a WebSocket upgrade to the /ws endpoint. This triggers an uncaught exception in the host-validation path, leading to the termination of the webpack-dev-server process. The potential ramifications include service disruption for developers relying on the server for application testing and development.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install webpack-dev-server@6.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.6
This is the first release that contains the fix.
npm install webpack-dev-server@5.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, keep the webpack-dev-server bound to localhost (the default setting) and avoid exposing it to untrusted networks. This limits the risk of unauthorized access and potential exploitation of the vulnerability.
Conclusion
The vulnerability CVE-2026-14631 in webpack-dev-server allows for denial of service through malformed Host or Origin headers. It is crucial to update to version 5.2.6 or later to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for webpack-dev-server →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The main consequence is a denial of service, where the webpack-dev-server can crash, disrupting the development workflow.
Yes, the vulnerability has been patched in webpack-dev-server version 5.2.6. Updating to this version will resolve the issue.
If you cannot update the package right away, ensure that the dev server is only accessible from localhost and not exposed to untrusted networks as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for webpack-dev-server.
