CVE-2026-6402 webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
An attacker can read application source code if webpack-dev-server runs over HTTP, exposing sensitive data to malicious websites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-6402?
CVE-2026-6402 is a medium-severity vulnerability in webpack-dev-server, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.
Weakness: CWE-749
Which versions are affected by CVE-2026-6402?
2 open source packages ship an affected version, including webpack-dev-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
webpack-dev-server npm | All versions | 5.2.4 |
webpack-dev-server npm | All versions | 5.2.4 |
Products include Webpack.js Webpack-Dev-Server.
How do I fix CVE-2026-6402?
Upgrade webpack-dev-server to 5.2.4 or later.
Is CVE-2026-6402 being exploited?
There is no known exploitation of CVE-2026-6402 in the wild and no public exploit code.
Other vulnerabilities in webpack-dev-server
- CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
- CVE-2018-14732 Missing Origin Validation in webpack-dev-server
- CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
- CVE-2026-114348 webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint
- CVE-2026-14631 webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Sources
Also known as CLEANSTART-2026-IF30069, CLSA-2026-1779238046, CLSA-2026-1784683094, CLSA-2026-1784769523, CLSA-2026-1784769600, CLSA-2026-1784856196 and 12 more.