CVE-2026-9595: webpack-dev-server HMR WebSocket Leaks Developer Credentials via Overly Broad Proxy Context

Technical summary

When webpack-dev-server is configured with a user-defined proxy rule that has a broad context path (/) and ws: true for WebSocket support, the proxy middleware incorrectly intercepts the dev server's internal HMR WebSocket connection. The HMR socket, intended for local development communication between the client and dev server, gets forwarded through the proxy chain to the backend target. This dual-write scenario on a single socket corrupts both streams. Additionally, cookies and the Origin header present in the browser's WebSocket upgrade request are forwarded to the proxy backend, and the dev server's Host/Origin validation is bypassed because the proxy acts as an intermediary. The vulnerability is rooted in insufficient path scope validation when WebSocket forwarding is enabled (CWE-346: Origin Validation Error, CWE-441: Unintended Proxy or Intermediary).

Business impact

In a development environment, this vulnerability exposes sensitive authentication tokens and session cookies to a backend server that may be controlled or monitored by an attacker. For development teams using webpack-dev-server with proxy configurations—a common setup when integrating with microservices or backend APIs—the leak happens transparently without developer awareness. If the proxy target is compromised, the attacker gains access to the developer's credentials. Additionally, HMR corruption can degrade the development experience and mask the actual vulnerability. While this is a dev-time issue, if development and staging environments share similar proxy configurations, the risk escalates. The CVSS score of 5.3 (Medium) reflects limited availability impact (HMR corruption) but acknowledges confidentiality loss via credential leakage.

Affected systems

webpack-dev-server versions prior to 5.2.5 are affected. The vulnerability requires a specific configuration: a user-defined proxy with a broad context (e.g., /) and ws: true enabled. Developers using narrower proxy contexts (e.g., /api) or those without WebSocket forwarding enabled are not vulnerable. The issue is present in the proxy middleware's path-matching logic and only manifests when both conditions are met.

Exploitability

Exploitability requires the developer to have misconfigured webpack-dev-server with both a broad proxy context and WebSocket forwarding enabled—a plausible but not universal configuration. An attacker cannot remotely trigger this; they must either control or monitor the proxy backend to observe leaked credentials and Origin headers. No user interaction is required beyond the developer starting the dev server. The vulnerability is not actively tracked as an exploited vulnerability in the wild (KEV status: not listed). However, because many developers routinely set proxy context to / as a catch-all and may enable ws: true without careful consideration, the real-world exposure is moderate.

Remediation

Upgrade webpack-dev-server to version 5.2.5 or later. This release fixes the path scope validation to ensure HMR WebSocket connections are not intercepted by user-defined proxies. For teams unable to upgrade immediately, two workarounds are available: (1) Restrict the proxy context to specific paths (e.g., /api, /v1) instead of using /, preventing the dev server's HMR path from being matched; (2) Remove ws: true from the proxy configuration if WebSocket forwarding to the backend is not required. Verify your webpack-dev-server configuration file to confirm proxy settings align with your backend architecture.

Patch guidance

Update webpack-dev-server dependency to 5.2.5 or any later release. This version is available on npm. After upgrading, no configuration changes are required if you were relying on the broader proxy context—the fix ensures HMR is properly excluded from proxy interception. If your project uses a lock file (package-lock.json or yarn.lock), run npm install or yarn install to pull the patched version. Verify the dev server restarts cleanly and HMR functionality works as expected in your development workflow. For npm: npm install [email protected] or update your package.json and reinstall dependencies.

Detection guidance

Review your webpack.config.js or webpack configuration for proxy settings. Look for entries where context is set to / or other broad patterns (e.g., * or empty string) combined with ws: true. If found, examine proxy backend logs for unexpected WebSocket connections and unusual request headers (particularly Origin headers from your development machine). Monitor dev server logs for socket errors or HMR failures that might indicate the corruption described. In a corporate environment, inspect network traffic from developer machines to external proxy targets; unexpected cookies or authentication headers in WebSocket frames to a proxy backend may signal this misconfiguration. Automated scanning tools can flag webpack configs with broad proxy contexts and ws: true combinations.

Why prioritize this

Although the CVSS score is Medium (5.3), this vulnerability should be addressed promptly because it directly exposes developer credentials and authentication tokens. Developer machines often have elevated access or tokens to staging/production systems, making credential leakage a gateway to lateral movement. The fix is straightforward (a version bump), and the workarounds are simple configuration adjustments. The relative lack of widespread exploitation (not in KEV) suggests patching can proceed without emergency protocols, but should not be deprioritized. Teams with developers working on microservice architectures or those using proxy for local API development should prioritize this update.

Risk score, explained

CVSS 5.3 (Medium) is assigned due to the vulnerability being network-accessible (AV:N) with low attack complexity (AC:L) and no privileges or user interaction required (PR:N/UI:N). However, the scope remains unchanged (S:U), and there is no direct confidentiality or integrity impact to the dev server itself—the impact is availability (A:L) of HMR and leakage of the developer's client-side secrets (cookies/Origin). The scoring reflects that exploitation requires a specific misconfiguration and affects development environments rather than production systems. The real-world risk to organizations depends on how developers' credentials are used downstream and whether the proxy backend is under attacker control.

Frequently asked questions