CVE-2025-56648: Parceljs Parcel XXE Vulnerability

CVE-2025-56648 Overview

CVE-2025-56648 affects the Parcel bundler (parceljs/parcel) versions 2.0.0-alpha and earlier. The vulnerability is an Origin Validation Error [CWE-346] in the Parcel development server. Malicious websites can issue cross-origin XMLHttpRequest calls to a developer's local Parcel dev server and read the responses. This allows attackers to steal source code from any developer who visits an attacker-controlled page while running Parcel locally. The issue was patched by adding Host and Origin header verification in the dev server and Hot Module Replacement (HMR) server components.

Critical Impact
Attackers can exfiltrate application source code from a developer's local Parcel dev server if the developer visits a malicious website while Parcel is running.

Affected Products

parceljs/parcel versions prior to the patched release
parceljs/parcel2.0.0-alpha0
Parcel development server and HMR server components

Discovery Timeline

2025-09-17 - CVE-2025-56648 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-56648

Vulnerability Analysis

The Parcel development server accepts cross-origin HTTP requests without validating the Origin or Host request headers. When a developer runs parcel locally, the dev server listens on a local port and serves bundled source assets. Any web page loaded in the developer's browser can issue an XMLHttpRequest or fetch call to that local port. Because same-origin policy permits sending the request and the server sends back readable content without origin checks, the attacker's JavaScript can read the response body. The response includes bundled JavaScript, source maps, and other project files served by the dev server, exposing proprietary source code.

Root Cause

The root cause is missing origin validation in the dev server request handlers. The HMR WebSocket server and the HTTP server in packages/reporters/dev-server did not enforce that inbound requests originated from an expected Host or Origin. Without this check, the dev server treats external websites as trusted clients.

Attack Vector

Exploitation requires the target developer to visit an attacker-controlled URL while the Parcel dev server is running on localhost. The malicious page uses JavaScript to send requests to well-known Parcel dev server ports and endpoints, receives responses containing source assets, and exfiltrates them to an attacker server. User interaction is required, but no privileges or authentication are needed.

javascript

// Security patch in packages/reporters/dev-server/src/HMRServer.js
// Verify Host and Origin headers in dev server
   Request,
   Response,
 } from './types.js.flow';
-import {setHeaders, SOURCES_ENDPOINT} from './Server';
+import {setHeaders, verifyOrigin, SOURCES_ENDPOINT} from './Server';
 
 import nullthrows from 'nullthrows';
 import url, {fileURLToPath} from 'url';
// Source: https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49

text

// Security patch in flow-libs/ws.js.flow
// Adds client origin metadata for WebSocket connections
   maxPayload?: number,
 |};
 
+declare type ws$ClientInfo = {|
+  origin: string
+|};
+
 // $FlowFixMe[incompatible-extend]
 declare class ws$WebSocketServer extends events$EventEmitter {
// Source: https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49

Detection Methods for CVE-2025-56648

Indicators of Compromise

Unexpected outbound HTTP requests from browser processes to attacker-controlled domains following visits to untrusted sites while the Parcel dev server is running
Inbound HTTP requests on the Parcel dev server port with Origin or Referer headers pointing to external domains
HMR WebSocket connections from unexpected origins in dev server logs

Detection Strategies

Inspect Parcel dev server access logs for requests where the Origin header does not match localhost or 127.0.0.1
Monitor developer workstations for browser network telemetry showing cross-origin requests targeting local development ports such as 1234
Search endpoint telemetry for node processes bound to local ports simultaneously receiving traffic tied to external browsing sessions

Monitoring Recommendations

Enable verbose logging on the Parcel dev server during active development to capture request headers
Use browser developer tools or network proxies on developer machines to identify unauthorized cross-origin requests
Correlate outbound POST or beacon traffic from browsers with recent visits to untrusted sites while parcel serve is running

How to Mitigate CVE-2025-56648

Immediate Actions Required

Upgrade parceljs/parcel to the version containing commit 4bc56e3242a85491c7edf589966e9b44c6330c49 or later, which adds verifyOrigin checks to the dev server
Restrict developer browsers to trusted sites while the Parcel dev server is active, or run development in an isolated browser profile
Bind the Parcel dev server to 127.0.0.1 only, never to 0.0.0.0, to prevent broader network exposure

Patch Information

The fix is available in the Parcel repository via commit 4bc56e3242a85491c7edf589966e9b44c6330c49. The patch introduces a verifyOrigin function used by both the HTTP dev server and the HMR WebSocket server to reject requests whose Host or Origin headers do not match the configured dev server address. Refer to the GitHub Discussion Thread and the GitHub Issue Report for maintainer commentary.

Workarounds

Stop the Parcel dev server (parcel serve) when not actively developing to eliminate the attack surface
Configure a local firewall rule to block inbound connections to the dev server port from processes other than the developer's browser targeting localhost
Use a separate browser profile or container for general web browsing that is distinct from the profile used to load the local dev server

bash

# Configuration example: upgrade Parcel and bind dev server to localhost
npm install --save-dev parcel@latest
npx parcel serve src/index.html --host 127.0.0.1 --port 1234