Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-03T17:23:41 webpack-dev-server: webpack-dev-server: Denial of Service via malformed headers 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-248

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

A flaw was found in webpack-dev-server. An unauthenticated remote attacker could send a specially crafted HTTP request with a malformed Host header or a WebSocket upgrade with a malformed Origin header. This malformed input causes an uncaught exception, leading to the termination of the Node.js process and crashing the development server. This vulnerability results in a Denial of Service (DoS), impacting the availability of the development server.

webpack-dev-server is a development-time tool used to serve files during local frontend development and is not started or executed in production deployments. While the package may appear in SBOM manifests due to its presence in build-stage node_modules, the webpack-dev-server process is not running in shipped container images or installed RPM packages, so the vulnerable code path (host/origin header validation) cannot be reached by an attacker in a production environment. webpack-dev-server should never be exposed to untrusted networks. By default, it binds to localhost only. Users who run webpack-dev-server during development should ensure it remains bound to localhost and upgrade to version 5.2.6 or later, which fixes the malformed header handling. Cryostat 4 Not affected cryostat-openshift-console-plugin-npm Cryostat 4 Not affected webpack-dev-server Gatekeeper 3 Not affected gatekeeper/gatekeeper-rhel9 Migration Toolkit for Containers Not affected rhmtc/openshift-migration-ui-rhel8 Node HealthCheck Operator Not affected workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Not affected workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Not affected workload-availability/node-healthcheck-rhel9-operator OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-console-plugin-419-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-console-plugin-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-hub-ui-rhel8 OpenShift Pipelines Not affected openshift-pipelines/pipelines-hub-ui-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-operator-bundle OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9-operator Red Hat AMQ Broker 7 Not affected webpack-dev-server Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Not affected automation-eda-controller Red Hat build of Apache Camel for Spring Boot 4 Not affected webpack-dev-server Red Hat build of Apache Camel - HawtIO 4 Not affected webpack-dev-server Red Hat Build of Podman Desktop Not affected rh-podman-desktop.git Red Hat Connectivity Link 1 Not affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 Not affected webpack-dev-server Red Hat Developer Hub Not affected rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 Not affected discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 10 Not affected grafana Red Hat Enterprise Linux 10 Not affected js-d3-flame-graph Red Hat Enterprise Linux 10 Not affected pcs Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 8 Not affected js-d3-flame-graph Red Hat Enterprise Linux 8 Not affected pcs Red Hat Enterprise Linux 9 Not affected grafana Red Hat Enterprise Linux 9 Not affected js-d3-flame-graph Red Hat Enterprise Linux 9 Not affected pcs Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-console-plugin Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 Not affected quay/quay-rhel8 Self-service automation portal 2 Not affected ansible-automation-platform/automation-portal https://www.cve.org/CVERecord?id=CVE-2026-14631 https://nvd.nist.gov/vuln/detail/CVE-2026-14631 https://cna.openjsf.org/security-advisories.html https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj