chore(deps): update dependency webpack-dev-server to v5.2.6 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
webpack-dev-server	5.2.5 → 5.2.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

CVE-2026-14631 / GHSA-m28w-2pqf-7qgj

More information

Details

Impact

An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.

Patches

Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #​5699).

Workarounds

Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj
• https://nvd.nist.gov/vuln/detail/CVE-2026-14631
• https://github.com/webpack/webpack-dev-server/pull/5699
• https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-m28w-2pqf-7qgj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

CVE-2026-14620 / GHSA-f5vj-f2hx-8m93

More information

Details

Impact

The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.

An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.

Patches

Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #​5698).

Workarounds

None

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93
• https://nvd.nist.gov/vuln/detail/CVE-2026-14620
• https://github.com/webpack/webpack-dev-server/pull/5698
• https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c
• https://cna.openjsf.org/security-advisories.html
• https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6
• https://github.com/advisories/GHSA-f5vj-f2hx-8m93

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

webpack/webpack-dev-server (webpack-dev-server)

v5.2.6

Compare Source

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #​5695)

  Restores accepting undefined (defaulting it to {}) for the options
  argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #​5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #​5699)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.