CVE-2026-6402 in webpack-dev-server
Summary
by MITRE • 05/12/2026
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/19/2026
The vulnerability in webpack-dev-server versions up to and including 5.2.3 represents a critical cross-origin resource exposure issue that fundamentally undermines the security of development environments. This flaw specifically affects deployments running over non-potentially trustworthy origins such as plain HTTP connections, creating a dangerous attack surface for developers who may be unaware of the implications. The vulnerability stems from an insufficient security model that relied on browser-provided headers to enforce cross-origin restrictions, which are inherently unreliable when operating over unencrypted connections where attackers can more easily manipulate or bypass these protections.
The technical implementation of this vulnerability exploits the absence of proper cross-origin resource policy enforcement in the server's response headers. The previous mitigation approach attempted to leverage Sec-Fetch-Mode and Sec-Fetch-Site request headers to determine whether requests should be allowed based on origin trustworthiness. However, browsers automatically omit these headers for non-trustworthy origins, effectively nullifying the intended security controls. This design flaw allows malicious websites to craft requests that can successfully load bundled source code as scripts, enabling unauthorized cross-origin data extraction. The attack vector specifically targets developers who are running webpack-dev-server over HTTP at predictable host and port combinations, making the exploitation relatively straightforward for attackers who can control a visited website.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with access to complete application source code including sensitive implementation details, business logic, and potentially hardcoded credentials or API keys. The attack requires only that a developer visits a malicious website while webpack-dev-server is running over HTTP, making it particularly dangerous in environments where developers frequently browse untrusted sites or where social engineering attacks are common. The vulnerability creates a persistent risk that can be exploited multiple times, as long as the developer maintains their development server running over HTTP and the attacker can predict the server's host and port configuration. This exposure is particularly concerning in corporate development environments where source code repositories may contain proprietary information or sensitive infrastructure details that could be leveraged for further attacks.
The mitigation strategy involves upgrading to webpack-dev-server version 5.2.4 or later, which implements proper Cross-Origin-Resource-Policy: same-origin headers on all responses. This change ensures that browser enforcement mechanisms prevent cross-origin access to the served content regardless of the request headers or origin characteristics. This fix directly addresses the underlying CWE-346 weakness related to improper validation of cross-origin requests and aligns with the ATT&CK technique T1592.001 for reconnaissance through information gathering. The solution provides a robust defense-in-depth approach that does not rely on browser-provided headers that can be manipulated or omitted, instead using explicit policy enforcement that works consistently across all browser versions. Organizations should also consider implementing additional security measures such as running development servers over HTTPS, using random port assignments, and implementing proper network segmentation to further reduce the attack surface. The Chromium-based browsers from Chrome 142 onward are not affected due to their implementation of local network access restrictions that prevent the type of cross-origin access that this vulnerability exploits.