CVE-2026-9595Medium· 5.3▾ Sunlitwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).
Fixed in webpack-dev-server 5.2.5.
Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
webpack-dev-server < 5.2.5Upgrade to a patched release:
webpack-dev-server 5.2.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-6734High· 7.5undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)
CVE-2026-85152High· 7.4undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool
CVE-2026-16158High· 8.7Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter
CVE-2026-61793Medium· 6.9Nuxt OG Image generates OG Images with Vue templates in Nuxt
CVE-2026-63643MediumMagicMirror² is an open source modular smart mirror platform
CVE-2026-70599Medium· 5.9Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS