The vulnerability occurs when webpack‑dev‑server is configured with a user proxy that has a broad context, such as /, and WebSocket forwarding (ws:true). This configuration causes the server’s own Hot‑Module‑Replacement WebSocket traffic to be captured and forwarded to the proxy target. As a result, the browser’s cookies, Origin header, and other sensitive request data are leaked to the upstream server, bypassing the dev server’s Host/Origin validation. The forwarded traffic also corrupts the HMR socket, potentially causing the development server and the proxy to write to the same socket.

All installations of webpack‑dev‑server older than 5.2.5 that use a proxy configuration with a wildcard context and ws:true. This includes any environment running webpack‑dev‑server in development that configures user‑defined proxies over the root path.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1% signifies a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control or influence the proxy target; a malicious upstream server could capture forwarded HMR traffic. In typical development settings, the attack vector is local or within a trusted network, so the primary risk is to developers and development servers that expose sensitive authentication cookies.