---
id: CVE-2026-14631
title: >-
  webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js
  process when an unauthenticated peer sends either a normal HTTP request with a
  malformed Host header or a WebSocket upgrade to the default /ws endpoint with
  a malf…
summary: >-
  webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js
  process when an unauthenticated peer sends either a normal HTTP request with a
  malformed Host header or a WebSocket upgrade to the default /ws endpoint with
  a malf…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-20
  - CWE-248
published: '2026-07-03'
updated: '2026-07-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14631'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj
    label: ce714d77-add3-4f53-aff5-83d477b104bb
tags:
  - nvd
ingestedAt: '2026-07-04T10:56:04.370Z'
epss: 0.00517
epssPercentile: 0.41421
---

## Overview

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.