CVE-2026-114348: webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value beginning with file: or with an extension scheme short-circuits the hostname and allowedHosts checks. A network peer that can reach the dev server can send a request with a malformed Host that passes validation and then causes the endpoint's URL construction to throw, and in the default non-production mode the server returns an HTTP 500 body containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers. The server keeps running, so there is no denial of service. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, and users should upgrade to one of those versions or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
webpack-dev-serverto a version that resolves this vulnerability.Fixed in 5.2.7 - Upgrade
Upgrade
webpack-dev-serverto a version that resolves this vulnerability.Fixed in 6.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any network peer that can reach the webpack-dev-server can exploit it. No authentication or user interaction is required.
Are default development deployments affected?
Yes. In the default non-production mode, the HTTP 500 response includes the full exception stack trace, exposing absolute filesystem paths, installed module locations, and internal source line numbers.
What does an attacker need to send?
The attacker must request the unauthenticated open-editor endpoint with a malformed Host header beginning with file: or an extension scheme. This bypasses the hostname and allowedHosts validation checks and triggers the error disclosure.
Does exploitation stop the development server?
No. The malformed request causes an error response, but the server continues running; this issue does not cause denial of service.
Which versions contain the fix?
Upgrade to webpack-dev-server 5.2.7 or later for the 5.x line, or 6.1.0 or later for the 6.x line. Affected releases are 5.1.0 before 5.2.7 and 6.0.0.