CVE-2018-14732 Missing Origin Validation in webpack-dev-server

What is CVE-2018-14732?

CVE-2018-14732 is a high-severity missing authorization vulnerability in n/a, published on 21 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Weakness: CWE-20

Which versions are affected by CVE-2018-14732?

2 open source packages ship an affected version, including webpack-dev-server. It affects 1 product.

Products include Webpack.js Webpack-Dev-Server.

How do I fix CVE-2018-14732?

Upgrade webpack-dev-server to 3.1.11 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-14732 being exploited?

There is no known exploitation of CVE-2018-14732 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades High 8.2
• CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser Medium 6.5
• CVE-2026-114348 webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint Medium 5.3
• CVE-2026-14631 webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header Medium 5.3
• CVE-2026-9595 webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1784683093, GHSA-cf66-xwfp-gvc4.