CVE-2025-30359: Webpack-dev-server XSS Vulnerability

CVE-2025-30359 Overview

CVE-2025-30359 is a source code disclosure vulnerability affecting webpack-dev-server, a development server that provides live reloading capabilities for webpack users. Prior to version 5.2.1, users' source code may be stolen when they access a malicious web site due to improper handling of classic script requests.

Because requests for classic scripts via script tags are not subject to the same-origin policy, an attacker can inject a malicious script on their own site that targets the webpack-dev-server. When combined with prototype pollution techniques, the attacker can obtain references to webpack runtime variables and extract source code using Function::toString against values in __webpack_modules__.

Critical Impact

Attackers can steal application source code from developers running vulnerable webpack-dev-server instances, potentially exposing proprietary code, API keys, and sensitive business logic.

Affected Products

• webpack.js webpack-dev-server versions prior to 5.2.1

Discovery Timeline

• June 3, 2025 - CVE CVE-2025-30359 published to NVD
• October 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-30359

Vulnerability Analysis

This vulnerability exploits a fundamental browser security gap where classic script requests made via <script> tags bypass same-origin policy restrictions. webpack-dev-server, which typically runs on localhost during development, serves JavaScript bundles that include the application's source code embedded within the __webpack_modules__ object.

The exploitation requires the attacker to know two pieces of information: the port number the webpack-dev-server is running on and the path to the output entrypoint script. In many development environments, these values are predictable defaults (commonly port 8080 and standard webpack output paths like /main.js or /bundle.js).

Once the attacker includes the victim's webpack bundle via a script tag on a malicious page, they can leverage prototype pollution techniques to gain access to the webpack runtime internals. The __webpack_modules__ object contains function references for each module in the application. By calling Function.prototype.toString() on these module functions, the attacker can reconstruct the original source code.

Root Cause

The root cause is classified under CWE-749 (Exposed Dangerous Method or Function). webpack-dev-server exposes bundled JavaScript containing application source code without adequate protections against cross-origin inclusion. The server did not implement appropriate safeguards to prevent malicious websites from loading and extracting code from development bundles served to the browser.

Attack Vector

The attack is network-based and requires the victim developer to visit a malicious website while their webpack-dev-server is running. The attacker's malicious page includes a script tag pointing to the victim's local development server:

The malicious script tag loads the webpack bundle from the victim's localhost. Using prototype pollution, the attacker manipulates JavaScript prototypes to intercept or access webpack's internal module registry. Once access is gained to __webpack_modules__, iterating through the module functions and calling toString() on each reveals the original source code, which can then be exfiltrated to the attacker's server.

Note that while the attack complexity is elevated due to the requirement to know the port and script path, common development configurations use predictable values, reducing this barrier in practice.

Detection Methods for CVE-2025-30359

Indicators of Compromise

• Unexpected cross-origin requests to webpack-dev-server ports from external domains
• Browser console errors related to script loading from localhost on unfamiliar sites
• Network traffic showing webpack bundle requests from external referrers
• Evidence of prototype pollution attempts in application logs or monitoring

Detection Strategies

• Monitor network traffic for requests to common webpack-dev-server ports (8080, 3000, 9000) from external origins
• Implement Content Security Policy (CSP) headers in development environments to restrict script loading
• Use browser developer tools to audit external script inclusions when visiting untrusted sites
• Deploy network monitoring tools to detect suspicious cross-origin resource loading patterns

Monitoring Recommendations

• Review webpack-dev-server access logs for requests with external Referer headers
• Configure browser-based monitoring extensions to alert on localhost resource access from external sites
• Audit development environment network configurations for unexpected exposure
• Implement egress filtering to detect potential source code exfiltration

How to Mitigate CVE-2025-30359

Immediate Actions Required

• Upgrade webpack-dev-server to version 5.2.1 or later immediately
• Avoid visiting untrusted websites while webpack-dev-server is running
• Configure firewall rules to restrict access to development server ports
• Use non-default ports for webpack-dev-server to reduce predictability

Patch Information

The webpack-dev-server team has released version 5.2.1 which contains a fix for this vulnerability. The patch is available via the GitHub commit d2575ad8dfed9207ed810b5ea0ccf465115a2239. For full details on the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-4v9v-hfq4-rm2v.

To update, run:

npm update webpack-dev-server

or

yarn upgrade webpack-dev-server

Workarounds

• Bind webpack-dev-server to 127.0.0.1 only and ensure it's not accessible from external networks
• Use firewall rules to block external access to development ports
• Implement a local proxy or VPN that restricts development server access
• Consider using browser profiles or containers to isolate development browsing from general web browsing

# Configuration example
# Restrict webpack-dev-server to localhost only in webpack.config.js
# devServer: {
#   host: '127.0.0.1',
#   port: 8080,
#   allowedHosts: ['localhost', '127.0.0.1'],
# }

# Firewall rule to block external access (Linux iptables)
iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP