CVE-2026-6402

May 12, 2026, 3:08 p.m.

5.3
Medium

Description

webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.

Product(s) Impacted

Vendor Product Versions
Webpack
  • Webpack-dev-server
  • <5.2.4

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-749
Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a webpack webpack-dev-server <5.2.4 / / / / / / /

References

https://cna.openjsf.org/security-advisories.html
https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w

Tags

CWE-749
ce714d77-add3-4f53-aff5-83d477b104bb
2026-05-12
CVE-2026-6402

CVSS Score

5.3 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

    View Vector String

Timeline

Published: May 12, 2026, 9:16 a.m.
Last Modified: May 12, 2026, 3:08 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

ce714d77-add3-4f53-aff5-83d477b104bb

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.