CVE-2026-114348

Undergoing Analysis Undergoing Analysis - In Progress

webpack-dev-server Path Disclosure via Malformed Host Header

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: openjs

Description

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value beginning with file: or with an extension scheme short-circuits the hostname and allowedHosts checks. A network peer that can reach the dev server can send a request with a malformed Host that passes validation and then causes the endpoint's URL construction to throw, and in the default non-production mode the server returns an HTTP 500 body containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers. The server keeps running, so there is no denial of service. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, and users should upgrade to one of those versions or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-114348

Affected Vendors & Products

Vendor	Product	Version / Range
webpack-dev-server	webpack-dev-server	5.1.0
webpack-dev-server	webpack-dev-server	6.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-1289	The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

Executive Summary

This vulnerability affects webpack-dev-server versions from 5.1.0 before 5.2.7 and version 6.0.0. It involves an unauthenticated open-editor endpoint that incorrectly validates the Host header using a regular expression meant for browser Origin schemes. This allows a malformed Host header starting with file: or an extension scheme to bypass hostname and allowedHosts checks. The endpoint then throws an error during URL construction, exposing sensitive filesystem paths, module locations, and source line numbers in an HTTP 500 error response.

Detection Guidance

Check the version of webpack-dev-server in use. If it is between 5.1.0 and 5.2.6 or version 6.0.0, the system is vulnerable. Run 'npm list webpack-dev-server' or check package.json to verify the installed version.

Impact Analysis

An attacker could exploit this to access sensitive filesystem paths, installed module locations, and internal source code details. This information could be used for further attacks like targeted exploits or reconnaissance. The server remains operational, so denial of service is not a concern.

Mitigation Strategies

Upgrade webpack-dev-server to version 5.2.7 or later, or to version 6.1.0 or later. This can be done using 'npm update webpack-dev-server' or by manually updating the package version in package.json and running 'npm install'.

Hi! I’m here to help you understand CVE-2026-114348. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70