Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-9595

22
FAUCET Score

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in [email protected]. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

First published: Jun 15, 2026Last modified: Jun 15, 2026

Impacted Technologies

VendorProductVersion(s)CPE
< 5.2.5CPE matchmatch criteria
cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.16%
Probability of exploitation in next 30 days
EPSS Percentile
5.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0016 is in the 2nd percentile among its peer group of 21,954 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: webpack-dev-serverFixed in: 5.2.5

Vendor Advisories (1)

npmGHSA-mx8g-39q3-5c79medium

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

Jun 17, 2026

References

cna.openjsf.org / security-advisories.html
Vendor Advisory
github.com / facebook/create-react-app/pull/7444
Issue TrackingPatch
github.com / vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb
Patch
github.com / webpack/webpack-dev-server/pull/4316
Issue TrackingPatch
github.com / webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79
MitigationVendor Advisory