{"id":"EUVD-2026-41559","enisaUuid":"e205f871-57bd-3fd2-ac72-ebc8b0bcd85f","description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","datePublished":"Jul 3, 2026, 5:23:41 PM","dateUpdated":"Jul 6, 2026, 3:54:11 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj\nhttps://cna.openjsf.org/security-advisories.html\n","aliases":"CVE-2026-14631\nGHSA-m28w-2pqf-7qgj\n","assigner":"openjs","epss":0.52,"enisaIdProduct":[{"id":"90884ebd-e5d7-31b9-8994-992979a9c58c","product":{"name":"webpack-dev-server","vendor":{"name":"webpack-dev-server"}},"product_version":"0 \u003c5.2.6"}],"enisaIdVendor":[{"id":"f34ef80c-7454-3952-bcf6-ce7ecf8a5026","vendor":{"name":"webpack-dev-server"}}],"enisaIdVulnerability":[{"id":"66ebb953-dc83-3cb9-9024-1122f54aff14","vulnerability":{"id":"CVE-2026-14631","description":"webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.","datePublished":"Jul 3, 2026, 5:23:41 PM","dateUpdated":"Jul 6, 2026, 3:54:11 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj\nhttps://cna.openjsf.org/security-advisories.html\n","enisa_id":"EUVD-2026-41559\n","assigner":"openjs","epss":0.52,"dataProcessed":"Nov 13, 2026, 7:24:48 AM","vulnerabilityProduct":[{"id":"82117ee3-8c58-325c-80f1-01d8d373fd54","product":{"name":"webpack-dev-server","vendor":{"name":"webpack-dev-server"}},"product_version":"0 \u003c5.2.6"}],"vulnerabilityVendor":[{"id":"4ccfadcc-5e38-3389-8085-d4ece54fa021","vendor":{"name":"webpack-dev-server"}}]}},{"id":"f4958da4-a7e4-350a-900e-ddce7abece5f","vulnerability":{"id":"GHSA-m28w-2pqf-7qgj","description":"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header","datePublished":"Jul 20, 2026, 10:02:31 PM","dateUpdated":"Jul 20, 2026, 10:02:31 PM","baseScore":0.0,"references":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-14631\nhttps://github.com/webpack/webpack-dev-server/pull/5699\nhttps://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f\nhttps://cna.openjsf.org/security-advisories.html\nhttps://github.com/webpack/webpack-dev-server\n","enisa_id":"EUVD-2026-41559\n","aliases":"CVE-2026-14631\nGHSA-m28w-2pqf-7qgj\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:50:23 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}