Bug 2496906 (CVE-2026-14631) - CVE-2026-14631 webpack-dev-server: webpack-dev-server: Denial of Service via malformed headers
Summary: CVE-2026-14631 webpack-dev-server: webpack-dev-server: Denial of Service via ...
Keywords:
Status: NEW
Alias: CVE-2026-14631
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-03 18:01 UTC by OSIDB Bzimport
Modified: 2026-08-15 08:28 UTC (History)
79 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-03 18:01:24 UTC
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.


Note You need to log in before you can comment on or make changes to this bug.