Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in [email protected]. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔒 New advisory: webpack-dev-server (CVE-2026-9595). A proxy with context / and ws: true intercepts the HMR WebSocket, leaking cookies to the backend. ✅ Patched in 5.2.5 https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79
Post summary
A new advisory for webpack‑dev‑server CVE‑2026‑9595 reveals a cookie leak via the HMR WebSocket with a proxy setting, and a patch is available in version 5.2.5.
🚨 Medium-severity security fix in webpack-dev-server@5.2.5 just released! Patches CVE-2026-9595. webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies. https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79
Post summary
A security fix has been released for CVE-2026-9595, addressing HMR WebSocket interception in webpack-dev-server and providing a patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | webpack.js | webpack-dev-server | - | - | - |