Sebastian Beltran on Mythryl: “🔒 New advisory: webpack-dev-server (CVE-2026-9595). A proxy with…”

🔒 New advisory: webpack-dev-server (CVE-2026-9595). A proxy with context / and ws: true intercepts the HMR WebSocket, leaking cookies to the backend. ✅ Patched in 5.2.5 github.com/webpack/webp...

github.comwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies### Impact When a user-configured proxy on `webpack-dev-server` has a broad context (e.g. `/`) and `ws: true`, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy ta...

15/6/26, 2:51 pm0 reposts2 likes

Post