CVE-2026-9595: webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Impact
When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches
Fixed in webpack-dev-server 5.2.5.
Workarounds
Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Other sources
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches: Fixed in webpack-dev-server.5.
Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
— Red Hat
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches: Fixed in webpack-dev-server@5.2.5.
Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/webpack-dev-serverto a version that resolves this vulnerability.Fixed in 5.2.5 - Upgrade
Upgrade
webpack-dev-serverto a version that resolves this vulnerability.Fixed in 5.2.5 - Configuration
Scope the user-defined proxy `context` to specific paths instead of `/` to prevent intercepting the dev server's own HMR WebSocket.
webpack-dev-server (proxy configuration) proxy.context = scope to specific paths instead of `/` - Configuration
If WebSocket forwarding is not required, omit `ws: true` from the proxy entry so the dev server does not forward/forward-intercept HMR WebSocket traffic.
webpack-dev-server (proxy configuration) proxy.ws = omit/disable ws: true when not required
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9595?
The severity of CVE-2026-9595 is medium with a score of 5.3.
How do I fix CVE-2026-9595?
To fix CVE-2026-9595, ensure that your proxy configuration on webpack-dev-server does not allow broad context interception.
What is the impact of CVE-2026-9595?
The impact of CVE-2026-9595 includes the potential leakage of browser cookies and the Origin header to the backend.
What software is affected by CVE-2026-9595?
CVE-2026-9595 affects the npm package webpack-dev-server.
How can CVE-2026-9595 affect my application?
CVE-2026-9595 can compromise your application by allowing malicious proxies to intercept sensitive data via HMR WebSocket.