webpack‑dev‑server forwards non‑Hot‑Module‑Replacement WebSocket upgrade requests to proxy targets without validating the Host or Origin headers. As a result, a malicious page accessed by a developer can open a cross‑origin WebSocket through the dev server, which is then relayed to the proxied backend. The attacker can read from and write to the backend service, even when the dev server is bound to the loopback interface. The flaw allows the exfiltration of data or injection of payloads into the proxied service, thereby compromising the confidentiality and integrity of that service.

All installations of webpack‑dev‑server that use a proxy configuration to forward WebSocket connections are affected when the version is earlier than 5.2.7 or exactly 6.0.0. The vulnerability is fixed in webpack‑dev‑server 5.2.7 and in the 6.x series from 6.1.0 onward. Systems running newer versions or without WebSocket‑forwarding proxies are not impacted.

The vulnerability scores a CVSS of 8.2, indicating high severity. EPSS data is not available and the issue is not listed in CISA’s KEV catalog, but that does not reduce the need for remediation. The attack vector requires that a malicious page be opened in the developer’s browser, which can access the dev server; this is common in local development environments. Because the flaw allows an attacker to manipulate a proxied backend, it represents a significant availability, confidentiality, and integrity risk.