Skip to content
Fencer Vulns
high 8.2

CVE-2026-112085 json

webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

published 2026-10-22 18 d ago modified 2026-10-29 11 d ago also EUVD-2026-108108

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket, and users should upgrade to one of those versions or later. As a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths.

Patch / fix

  • webpack-dev-server webpack-dev-server 5.2.7, 6.1.0
  • git-bug openSUSE Tumbleweed 0.11.0-3.1

opensuse advisories openSUSE-SU-2026:12261-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-112085 updated cvss 8.2

webpack-dev-server: webpack-dev-server: unauthorized backend access via unvalidated WebSocket proxy requests

  • Red Hat Hardened Images prometheus3.13 3.13.4-0.2.hum1
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 d ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Affected products

  • webpack-dev-server webpack-dev-server

Classification

Weakness
  • CWE-346 Origin Validation Error
  • CWE-1385 Missing Origin Validation in WebSockets

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.