Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114348— webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

Quick assessment

Affected
webpack-dev-server webpack-dev-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

webpack-dev-server 是为 webpack 项目提供热重载功能的开发服务器。在 5.1.0 至 5.2.7 之前的版本以及 6.0.0 版本中，未经验证的 open-editor 端点使用原本用于浏览器 Origin 方案的正则表达式来验证 Host 请求头。因此，若 Host 值以 开头或包含扩展方案（extension scheme），则会绕过主机名和 allowedHosts 的检查。能够访问该开发服务器的网络对等方可发送一个构造畸形的 Host 请求，使其通过验证，进而导致该端点在构建 UR

CVSS 5.3 · Medium EPSS 0.34% · P27

Affected Version Matrix 4

VendorProduct Version RangeStatus
webpack-dev-server webpack-dev-server 5.1.0< 5.2.7 affected
5.2.7 unaffected
6.0.0< 6.1.0 affected
6.1.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114348

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value beginning with file: or with an extension scheme short-circuits the hostname and allowedHosts checks. A network peer that can reach the dev server can send a request with a malformed Host that passes validation and then causes the endpoint's URL construction to throw, and in the default non-production mode the server returns an HTTP 500 body containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers. The server keeps running, so there is no denial of service. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, and users should upgrade to one of those versions or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
webpack-dev-server webpack-dev-server 5.1.0 ~ 5.2.7 -

II. Public POCs for CVE-2026-114348

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114348

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-114348 (1)

IV. Related Vulnerabilities

Same product: webpack-dev-server
Same vendor: webpack-dev-server
Same weakness: CWE-209

V. Comments for CVE-2026-114348

No comments yet

Leave a comment