CVE-2026-6402: webpack-dev-server Info Disclosure Flaw

CVE-2026-6402 Overview

CVE-2026-6402 is a cross-origin source code disclosure vulnerability in webpack-dev-server versions up to and including 5.2.3. A malicious website visited by a developer can load the dev server's bundled JavaScript as a cross-origin script and read the application source code. The flaw exists because a previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit on non-potentially-trustworthy origins such as plain HTTP. The issue is classified under [CWE-749: Exposed Dangerous Method or Function]. Chromium-based browsers from Chrome 142 onward are not affected due to local network access restrictions.

Critical Impact
An attacker controlling a website visited by a developer running webpack-dev-server can recover proprietary application source code when the dev server runs over HTTP at a guessable host and port.

Affected Products

webpack-dev-server versions <= 5.2.3
Development environments serving bundles over plain HTTP
Non-Chromium browsers and Chromium versions earlier than Chrome 142

Discovery Timeline

2026-05-12 - CVE-2026-6402 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-6402

Vulnerability Analysis

The vulnerability allows cross-origin theft of bundled JavaScript served by webpack-dev-server. When a developer visits a malicious page, that page can include a <script> tag pointing at the developer's local dev server, typically reachable at a guessable host and port such as http://localhost:8080/main.js. The browser fetches and executes the script in the context of the attacker's origin, exposing application source code, embedded secrets, and internal API structures.

The earlier mitigation inspected the Sec-Fetch-Mode and Sec-Fetch-Site request headers to reject cross-origin script loads. Browsers, however, do not send these headers when the destination is a non-potentially-trustworthy origin such as plain HTTP. This gap allows the malicious request to bypass server-side origin validation.

Root Cause

The root cause is incomplete enforcement of cross-origin isolation on responses served by the dev server. The server depended on optional fetch metadata headers rather than setting a definitive response-side policy such as Cross-Origin-Resource-Policy. On HTTP origins, the missing request headers caused the validation logic to fail open.

Attack Vector

Exploitation requires user interaction. A developer must run webpack-dev-server locally and visit an attacker-controlled web page. The attacker embeds a script tag referencing the dev server's bundle URL. The attacker may also use error handlers or property accessors on the loaded script to read sensitive substrings. The attack vector is network-based, complexity is high because the attacker must guess the host and port, and confidentiality impact is significant.

No verified public proof-of-concept code is available. See the GitHub Webpack Dev Server Advisory for additional technical details.

Detection Methods for CVE-2026-6402

Indicators of Compromise

Unexpected cross-origin requests in dev server access logs targeting bundle paths such as /main.js, /bundle.js, or hashed chunk files
Requests to the dev server with Referer headers pointing to unfamiliar external domains
Outbound connections from developer workstations to suspicious domains while webpack-dev-server is running

Detection Strategies

Inspect dev server logs for HTTP GET requests to bundle assets originating from non-localhost referrers
Use endpoint telemetry to identify developer machines running webpack-dev-server versions at or below 5.2.3
Monitor browser-initiated requests to localhost ports from non-local origins via host-based proxies or browser security extensions

Monitoring Recommendations

Build a software inventory query that flags installed webpack-dev-server packages below 5.2.4 across developer endpoints
Alert on dev server processes binding to non-loopback interfaces, which broadens the attack surface beyond localhost
Correlate browser process network activity with active dev server ports to detect anomalous cross-origin fetches

How to Mitigate CVE-2026-6402

Immediate Actions Required

Upgrade webpack-dev-server to version 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses
Audit developer workstations for vulnerable versions using package manifests such as package-lock.json and yarn.lock
Restrict the dev server to the loopback interface by binding to 127.0.0.1 rather than 0.0.0.0

Patch Information

The fix ships in webpack-dev-server5.2.4. The patched release sets Cross-Origin-Resource-Policy: same-origin on served responses, which instructs compliant browsers to block cross-origin script loads regardless of fetch metadata headers. Refer to the OpenJS Foundation Security Advisories and the GitHub Webpack Dev Server Advisory for release details.

Workarounds

Serve the dev server over HTTPS using a locally trusted certificate so browsers send Sec-Fetch-* headers
Use Chromium-based browsers from Chrome 142 or later, which enforce local network access restrictions
Configure firewall rules that block inbound connections to dev server ports from non-loopback sources

bash

# Upgrade webpack-dev-server to the patched release
npm install --save-dev webpack-dev-server@^5.2.4

# Verify installed version
npm ls webpack-dev-server

# Bind dev server to loopback only (webpack.config.js)
# devServer: { host: '127.0.0.1', server: 'https' }