REDHAT-BUG-2488934: High severity webpack webpack-dev-server vulnerability
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Patches: Fixed in webpack-dev-server.5.
Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
webpack-dev-serverto a version that resolves this vulnerability.Fixed in 5. - Configuration
Scope the user-defined proxy context to specific paths rather than using a broad context like '/'
webpack-dev-server (proxy configuration) proxy context (where the proxy applies) = specific paths instead of / - Configuration
Remove 'ws: true' from the proxy entry if WebSocket forwarding is not required (so dev server does not forward HMR/proxy WebSockets to the target).
webpack-dev-server (proxy configuration) ws = omit ws: true when WebSocket forwarding is not required
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2488934?
The severity of REDHAT-BUG-2488934 is rated high, specifically a score of 7.
What impact does REDHAT-BUG-2488934 have?
REDHAT-BUG-2488934 allows the interception of the dev server's HMR WebSocket, which can leak browser cookies and the Origin header to the backend.
How do I fix REDHAT-BUG-2488934?
To fix REDHAT-BUG-2488934, ensure that your proxy configuration on webpack-dev-server does not use a broad context and review the settings related to ws.
Who is affected by REDHAT-BUG-2488934?
Users of webpack-dev-server with a user-configured proxy that has a broad context and ws: true are affected by REDHAT-BUG-2488934.
When was REDHAT-BUG-2488934 published?
REDHAT-BUG-2488934 was published on June 15, 2026.