chore(deps): update dependency webpack-dev-server to v5.2.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
webpack-dev-server	5.2.5 → 5.2.6

---

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

CVE-2026-14620 / GHSA-f5vj-f2hx-8m93

More information

Details

Impact

The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.

An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.

Patches

Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #​5698).

Workarounds

None

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93
• https://nvd.nist.gov/vuln/detail/CVE-2026-14620
• https://github.com/webpack/webpack-dev-server/pull/5698
• https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c
• https://cna.openjsf.org/security-advisories.html
• https://github.com/webpack/webpack-dev-server
• https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

CVE-2026-14631 / GHSA-m28w-2pqf-7qgj

More information

Details

Impact

An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.

Patches

Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #​5699).

Workarounds

Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj
• https://nvd.nist.gov/vuln/detail/CVE-2026-14631
• https://github.com/webpack/webpack-dev-server/pull/5699
• https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f
• https://cna.openjsf.org/security-advisories.html
• https://github.com/webpack/webpack-dev-server

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

webpack/webpack-dev-server (webpack-dev-server)

v5.2.6

Compare Source

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #​5695)

  Restores accepting undefined (defaulting it to {}) for the options
  argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #​5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #​5699)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Note

Low Risk
Lockfile-only dev-dependency patch in an example project; no runtime or production code paths change.

Overview
Bumps webpack-dev-server from 5.2.5 to 5.2.6 in examples/webpack/package-lock.json only (dev tooling for the webpack Cypress example). The lockfile also picks up a resolved launch-editor bump (^2.14.1) as part of the updated dependency tree.

This is a security patch release: it hardens internal dev-server routes against cross-site abuse and avoids process crashes from malformed Host/Origin headers. No application or Cypress test source changes.

^{Reviewed by Cursor Bugbot for commit add57ae. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cypress-app-bot]

See the guidelines for reviewing dependency updates for info on how to review dependency update PRs.