CVE-2026-9595

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket (ws: true) forwarding, the development server's own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser's cookies and Origin header to the proxy target, bypassing the server's Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.

This vulnerability is rated as having an Important impact because improper handling of broad proxy routes allows sensitive browser data, including session tokens and origin metadata, to be exfiltrated to backend targets while circumventing server origin checks. In Red Hat environments, webpack-dev-server is primarily utilized in development workflows, frontend build pipelines, and containerized development tooling rather than production service delivery. However, when local or containerized development servers are configured with overly permissive proxy rules, remote attackers can compromise session integrity and trigger denial-of-service conditions during development sessions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid configuring webpack-dev-server with a broad proxy context (e.g., /) when WebSocket forwarding (ws: true) is enabled. Instead, define specific paths for the proxy context. Alternatively, disable WebSocket forwarding by omitting ws: true from the proxy entry if WebSocket functionality is not required for the proxy target. This configuration change may require restarting the webpack-dev-server instance to take effect.