CVE-2026-14631

A flaw was found in webpack-dev-server. An unauthenticated remote attacker could send a specially crafted HTTP request with a malformed Host header or a WebSocket upgrade with a malformed Origin header. This malformed input causes an uncaught exception, leading to the termination of the Node.js process and crashing the development server. This vulnerability results in a Denial of Service (DoS), impacting the availability of the development server.

webpack-dev-server is a development-time tool used to serve files during local frontend development and is not started or executed in production deployments. While the package may appear in SBOM manifests due to its presence in build-stage node_modules, the webpack-dev-server process is not running in shipped container images or installed RPM packages, so the vulnerable code path (host/origin header validation) cannot be reached by an attacker in a production environment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.