By vendor

Webpack.Js vulnerabilities

Known CVEs affecting Webpack.Js products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-9595MEDIUM 5.3

  webpack-dev-server's Hot Module Replacement (HMR) feature can be inadvertently exposed to a user-configured proxy when the proxy context is set broadly (such as /). If WebSocket forwarding is enabled on that proxy, the dev server mistakenly routes its internal HMR WebSocket through the proxy to a backend server. This causes sensitive data—browser cookies and the Origin header—to leak to that backend, circumvents the dev server's built-in Host/Origin protections, and corrupts the HMR socket since both HMR and the proxy write to the same connection. The flaw affects webpack-dev-server versions before 5.2.5.