Severity
5.3
Medium severity
Details
- CVSS score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Overview
About vulnerability
Impact
An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.
Patches
Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see [PR #5699](https://github.com/webpack/webpack-dev-server/pull/5699)).
Workarounds
Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Details
- Affected product:
- webpack-dev-server
- Affected packages:
- webpack-dev-server @ 4.15.2 (+1 more)