CVE-2026-14631: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Impact
An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.
Patches
Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #5699).
Workarounds
Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Other sources
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/webpack-dev-serverto a version that resolves this vulnerability.Fixed in 5.2.6 - Upgrade
Upgrade
webpack-dev-serverto a version that resolves this vulnerability.Fixed in 5.2.6Patch PR #5699 - Configuration
Keep webpack-dev-server bound to localhost (default) and do not expose it to untrusted networks.
webpack-dev-server host binding = localhost
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14631?
The severity of CVE-2026-14631 is medium, with a rating of 5.3.
How does CVE-2026-14631 affect webpack-dev-server?
CVE-2026-14631 affects webpack-dev-server by allowing an unauthenticated peer to terminate the Node.js process via malformed Host or Origin headers.
What versions of webpack-dev-server are vulnerable to CVE-2026-14631?
webpack-dev-server versions 5.2.5 and earlier are vulnerable to CVE-2026-14631.
How can I mitigate the risks associated with CVE-2026-14631?
To mitigate CVE-2026-14631, upgrade to a patched version of webpack-dev-server after 5.2.5.
What impact does a denial of service have in relation to CVE-2026-14631?
A denial of service impact from CVE-2026-14631 results in the complete termination of the Node.js process, disrupting service availability.