Skip to content
Fencer Vulns
medium 5.3

CVE-2026-6402 json

webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

published 2026-05-12 5 mo ago modified 2026-09-10 1 mo ago also GHSA-79cf-xcqc-c78w , EUVD-2026-29404

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.

Patch / fix

  • npm webpack-dev-server 5.2.4
  • webpack-dev-server webpack-dev-server 5.2.4
  • agama-web-ui openSUSE Tumbleweed 21+360.16caae772-44.1

opensuse advisories openSUSE-SU-2026:10979-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6402 updated cvss 5.3

webpack-dev-server: webpack-dev-server: Information disclosure due to cross-origin source code exposure

  • Red Hat Cryostat 4 webpack-dev-server, cryostat-openshift-console-plugin-npm Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9
    +13 more products
    Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat AMQ Broker 7 webpack-dev-server Red Hat Ansible Automation Platform 2 automation-eda-controller, ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9 Red Hat build of Apache Camel - HawtIO 4 webpack-dev-server Red Hat build of Apache Camel for Spring Boot 4 webpack-dev-server Red Hat build of Apicurio Registry 2 webpack-dev-server Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Data Grid 8 webpack-dev-server Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-loki, grafana-mssql, grafana-mysql, +10 more Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, grafana-selinux, js-d3-flame-graph
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 10 pcs, grafana, js-d3-flame-graph
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 webpack-dev-server Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-console-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 webpack-dev-server
    +2 more products
    Red Hat Quay 3 quay/quay-rhel8 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm webpack-dev-server
<5.2.4
5.2.4

Affected products

  • webpack-dev-server webpack-dev-server

Classification

Weakness
  • CWE-749 Exposed Dangerous Method or Function

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.