{"id":"CVE-2026-6402","sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","published":"2026-05-12T09:16:55.640","lastModified":"2026-11-11T20:10:00.273","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses."},{"lang":"es","value":"Las versiones de webpack-dev-server hasta la 5.2.3 inclusive son vulnerables a la exposición de código fuente de origen cruzado al servir a través de un origen no potencialmente confiable, como HTTP simple. La solución anterior dependía de los encabezados de solicitud Sec-Fetch-Mode y Sec-Fetch-Site, que los navegadores omiten para orígenes no confiables, permitiendo que un sitio malicioso cargue el código fuente empaquetado como un script y lo lea a través de orígenes. Impacto: un atacante que controla un sitio web visitado por un desarrollador que ejecuta webpack-dev-server puede recuperar el código fuente de la aplicación cuando el servidor de desarrollo se ejecuta sobre HTTP en un host y puerto predecibles. Los navegadores basados en Chromium a partir de Chrome 142 no se ven afectados debido a restricciones de acceso a la red local. Actualice a webpack-dev-server 5.2.4 o posterior, que establece Cross-Origin-Resource-Policy: same-origin en las respuestas."}],"affected":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","affectedData":[{"vendor":"webpack-dev-server","product":"webpack-dev-server","defaultStatus":"unaffected","packageURL":"pkg:npm/webpack-dev-server","versions":[{"version":"0","lessThan":"5.2.4","versionType":"semver","status":"affected"},{"version":"5.2.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-12T12:57:17.986993Z","id":"CVE-2026-6402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","description":[{"lang":"en","value":"CWE-749"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.2.4","matchCriteriaId":"F7A95333-66AD-4DB6-993F-079B745E0C59"}]}]}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","source":"ce714d77-add3-4f53-aff5-83d477b104bb","tags":["Vendor Advisory"]},{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w","source":"ce714d77-add3-4f53-aff5-83d477b104bb","tags":["Mitigation","Vendor Advisory"]}]}