CVE-2026-14631
Description
A flaw was found in webpack-dev-server. An unauthenticated remote attacker could send a specially crafted HTTP request with a malformed Host header or a WebSocket upgrade with a malformed Origin header. This malformed input causes an uncaught exception, leading to the termination of the Node.js process and crashing the development server. This vulnerability results in a Denial of Service (DoS), impacting the availability of the development server.
Statement
webpack-dev-server is a development-time tool used to serve files during local frontend development and is not started or executed in production deployments. While the package may appear in SBOM manifests due to its presence in build-stage node_modules, the webpack-dev-server process is not running in shipped container images or installed RPM packages, so the vulnerable code path (host/origin header validation) cannot be reached by an attacker in a production environment.
Mitigation
webpack-dev-server should never be exposed to untrusted networks. By default, it binds to localhost only. Users who run webpack-dev-server during development should ensure it remains bound to localhost and upgrade to version 5.2.6 or later, which fixes the malformed header handling.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | 5.3 |
| Attack Vector | Adjacent Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat CVSS v3 Score Explanation
AV:A — webpack-dev-server is a development-only tool, never network-exposed in production
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
