CVE-2025-30359: webpack-dev-server Source Code Theft Vulnerability
Summary
CVE-2025-30359: webpack-dev-server users' source code may be stolen when they access a malicious web site. Affects webpack-dev-server versions < 5.2.1. Fixed in 5.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
webpack-dev-server is a popular development server for webpack, providing live reloading and a fast development experience. It allows developers to serve their applications locally and see changes in real-time. However, it has a vulnerability that can expose source code when accessed from a malicious website, particularly when certain configurations are used.
Vulnerability Detail
The vulnerability arises from the fact that the classic script requests made via script tags are not subject to the same origin policy. An attacker can inject a script tag pointing to a local webpack-dev-server instance, allowing them to execute code that can access webpack runtime variables. This can lead to the theft of source code through prototype pollution and the use of Function::toString on the values in webpack_modules. If the attacker knows the port and output entrypoint script path, they can exploit this vulnerability to gain unauthorized access to the source code.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install webpack-dev-server@6.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.1
This is the first release that contains the fix.
npm install webpack-dev-server@5.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using predictable ports and output paths for your entrypoint scripts. Additionally, consider setting output.iife to true in your webpack configuration to encapsulate the webpack runtime variables and prevent them from being exposed globally.
Conclusion
The CVE-2025-30359 vulnerability in webpack-dev-server poses a significant risk of source code theft when accessed from malicious sites. It is crucial for developers to update their packages to the latest version to mitigate this risk and to implement workarounds if immediate updates are not feasible.
See every vulnerability recorded for webpack-dev-server →
FAQ
CVE-2025-30359 is a vulnerability in webpack-dev-server that allows attackers to steal source code by injecting scripts into a malicious website.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access to your application's source code, which can be detrimental to your intellectual property and security.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
If you cannot update the package immediately, implement the suggested workaround by changing your output paths and ports, and consider using output.iife to encapsulate your webpack runtime variables.
References
Related vulnerabilities
Recent vulnerabilities recorded for webpack-dev-server.
