CVE-2026-9595

[CVE catalog]

Severity

High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Published

Jun 15, 2026, 3:00:21 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.16% · Oct 25, 2026

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket (ws: true) forwarding, the development server's own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser's cookies and Origin header to the proxy target, bypassing the server's Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality. webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration This vulnerability is rated as having an Important impact because improper handling of broad proxy routes allows sensitive browser data, including session tokens and origin metadata, to be exfiltrated to backend targets while circumventing server origin checks. In Red Hat environments, webpack-dev-server is primarily utilized in development workflows, frontend build pipelines, and containerized development tooling rather than production service delivery. However, when local or containerized development servers are configured with overly permissive proxy rules, remote attackers can compromise session integrity and trigger denial-of-service conditions during development sessions. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.