webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 12:17:59 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
npmwebpack-dev-serverpkg:npm/webpack-dev-serverOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is available, users should consider restricting WebSocket proxying configurations and applying network-level controls to limit cross-origin WebSocket access where feasible.
Description
A vulnerability identified as CVE-2026-112085 affects webpack-dev-server version 3.0, allowing cross-origin WebSocket access via proxied upgrades. This issue relates to improper handling of WebSocket upgrade requests that could enable unauthorized cross-origin access. No CVSS score is provided, and there is no indication of known exploits in the wild. No patch or remediation details are currently available.
Impact
The vulnerability could allow unauthorized cross-origin WebSocket connections, potentially exposing sensitive data or enabling unauthorized actions through the WebSocket channel. However, no active exploitation has been reported, and the exact impact depends on the deployment context and usage of the affected webpack-dev-server version.
Summary
CVE-2026-112085 describes a security vulnerability in webpack-dev-server version 3.0 where cross-origin WebSocket access can occur through proxied upgrade requests. This vulnerability is categorized under CWE-346, which involves improper verification of cryptographic signatures or message authentication codes, potentially leading to unauthorized access. The vulnerability arises from the server's handling of WebSocket upgrade requests that are proxied, allowing cross-origin connections that should be restricted.
Weaknesses
- CWE-346Origin Validation Error (opens in a new tab)
Class weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not properly verify that the source of data or communication is valid.