CVE-2026-14631
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Description
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
INFO
Published Date :
July 3, 2026, 5:23 p.m.
Last Modified :
July 3, 2026, 5:23 p.m.
Remotely Exploit :
Yes !
Source :
openjs
Affected Products
The following products are affected by CVE-2026-14631
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | ce714d77-add3-4f53-aff5-83d477b104bb | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Upgrade webpack-dev-server to version 5.2.6 or later.
- Restrict dev server access to localhost.
- Avoid exposing the dev server to untrusted networks.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-14631 vulnerability anywhere in the article.