CVE-2026-6402: webpack-dev-server Cross-Origin Source Code Exposure on Non-HTTPS Origins
Summary
CVE-2026-6402: webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins. Affects webpack-dev-server versions < 5.2.4. Fixed in 5.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
webpack-dev-server is a popular development server for serving JavaScript applications, particularly those built with Webpack. It provides features such as live reloading and hot module replacement, making it easier for developers to build and test their applications in real-time. However, when running on non-HTTPS origins, it is vulnerable to cross-origin attacks that can expose sensitive source code.
Vulnerability Detail
The vulnerability arises when webpack-dev-server operates over a non-HTTPS connection, allowing malicious websites to make cross-origin requests that can load the server's JavaScript bundles. This can lead to the exfiltration of module source code by intercepting the webpack runtime's module registration. The initial fix in version 5.2.1 relied on specific request headers that are not sent over plain HTTP, making it ineffective in this context. This issue does not affect Chrome 142+ due to local network access restrictions.
How To Fix
Latest published version: 6.1.0 as of 22 Oct 2026
npm install webpack-dev-server@6.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.4
This is the first release that contains the fix.
npm install webpack-dev-server@5.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can run the dev server with HTTPS enabled by using the following command: webpack-dev-server --https. Alternatively, you can set 'server.type: https' in your configuration file.
Conclusion
In summary, the CVE-2026-6402 vulnerability in webpack-dev-server poses a significant risk when running on non-HTTPS origins. It is crucial to update to version 5.2.4 or later to mitigate this risk. Additionally, using HTTPS as a workaround can help protect your application until the update is applied.
See every vulnerability recorded for webpack-dev-server →
FAQ
The vulnerability allows attackers to load and potentially exfiltrate the source code of your application if the dev server is running over HTTP.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application without any signup using the Vulert playground.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
Yes, you can run the dev server with HTTPS enabled as a temporary workaround until you can update to the patched version.
Failure to address this vulnerability could lead to unauthorized access to your application's source code, potentially exposing sensitive information and increasing the risk of further attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for webpack-dev-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
