{"id":"CVE-2026-114348","title":"webpack-dev-server: webpack-dev-server: Information disclosure via malformed Host header (CVE-2026-114348)","summary":"A flaw was found in webpack-dev-server. An unauthenticated remote attacker can exploit improper Host header validation in the open-editor endpoint to obtain sensitive technical information. By sending a request with a specially crafted Hos…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"vendor","cwe":["CWE-209","CWE-1289"],"vendor":"Red Hat","product":"webpack-dev-server","affected":["webpack-dev-server >= 5.1.0 < 5.2.7","webpack-dev-server >= 6.0.0 < 6.1.0"],"published":"2026-10-22","updated":"2026-10-23","sourceUpdated":"2026-10-23T00:16:04+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114348.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114348.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114348"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558806"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114348"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114348"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-wqhc-fvfg-56q6"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00343,"epssPercentile":0.26563,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-22T12:54:40.727618Z"},"ingestedAt":"2026-10-22T10:35:54.919Z","slug":"CVE-2026-114348","body":"## Overview\n\nA flaw was found in webpack-dev-server. An unauthenticated remote attacker can exploit improper Host header validation in the open-editor endpoint to obtain sensitive technical information. By sending a request with a specially crafted Host header, the attacker triggers an internal server error that returns a full error stack trace. This exposes environment details, including local file system paths, module locations, and internal source code references.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114348.json)\n\n**webpack-dev-server: webpack-dev-server: Information disclosure via malformed Host header** — rated Moderate by Red Hat. Released 2026-10-22, updated 2026-10-23.\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}