CVE-2026-9595

Katalog CVE

CVSS 4.3 · Medium EPSS 0,23%

Kerentanan Origin Validation Error pada webpack.js webpack-dev-server. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

Rincian

Terbit di NVD

15 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cna.openjsf.org/security-advisories.html advisory vendor
• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79 mitigasi · advisory vendor
• https://github.com/facebook/create-react-app/pull/7444 issue tracking · patch
• https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb patch
• https://github.com/webpack/webpack-dev-server/pull/4316 issue tracking · patch