Missing Origin Validation in browserify-hmr

published 2018-09-21 8 y ago modified 2026-06-17 4 mo ago also GHSA-77q4-m83q-w76v , EUVD-2020-0849

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/ connection from any origin.

Patch / fix

fixed in 1

npm browserify-hmr 0.4.0

Exploit prediction

1.69% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

blog.cal1.cn https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	browserify-hmr	<0.4.0	0.4.0

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

blog.cal1.cn /post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages
web, exploit, third-party-advisory
github.com /AgentME/browserify-hmr/issues/41
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2018-14730
advisory
blog.cal1.cn /post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages)
web
github.com /AgentME/browserify-hmr
package
npmjs.com /advisories/726
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary