{"id":"GHSA-mx8g-39q3-5c79","summary":"webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies","details":"### Impact\n\nWhen a user-configured proxy on `webpack-dev-server` has a broad context (e.g. `/`) and `ws: true`, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and `Origin` header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).\n\n### Patches\n\nFixed in `webpack-dev-server` 5.2.5.\n\n### Workarounds\n\nScope user-defined proxy `context` to specific paths instead of `/`, or omit `ws: true` from the proxy entry when WebSocket forwarding is not required.","aliases":["CVE-2026-9595"],"modified":"2026-07-17T21:10:05.908071221Z","published":"2026-06-17T18:13:31Z","database_specific":{"cwe_ids":["CWE-346","CWE-441"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-06-17T18:13:31Z","nvd_published_at":"2026-06-15T16:16:35Z"},"references":[{"type":"WEB","url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595"},{"type":"WEB","url":"https://github.com/facebook/create-react-app/pull/7444"},{"type":"WEB","url":"https://github.com/webpack/webpack-dev-server/pull/4316"},{"type":"WEB","url":"https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/webpack/webpack-dev-server"}],"affected":[{"package":{"name":"webpack-dev-server","ecosystem":"npm","purl":"pkg:npm/webpack-dev-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mx8g-39q3-5c79/GHSA-mx8g-39q3-5c79.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}