CVE-2026-112085
HIGH 8.2webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket, and users should upgrade to one of those versions or later. As a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths.
Severe if exploited (CVSS 8.2), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 4th percentile
Impact if exploited
8.2CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-346: : Origin Validation Error
- CWE-1385: : Missing Origin Validation in WebSockets
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
References and research data (JSON)
Vendor product assessments
prometheus3.13.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: component not present
pkg:rpm/redhat/[email protected]?arch=src
Red Hat · CVE-2026-112085 · Updated 2026-10-22T20:16:58+00:00
All CVSS metrics
- HIGH 8.2 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - HIGH 8.2 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112085.json Red Hat · CVE-2026-112085 · Updated 2026-10-22T20:16:58+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108108 EUVD · EUVD-2026-108108
Technical & other
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-cfqc-fj3v-j925 CVE record · openjs · Updated 2026-10-22T09:31:59.124Z
NVD · CVE-2026-112085 · Updated 2026-10-22T15:25:10.067
Red Hat · CVE-2026-112085 · Updated 2026-10-22T20:16:58+00:00 - https://cna.openjsf.org/security-advisories.html CVE record · openjs · Updated 2026-10-22T09:31:59.124Z
NVD · CVE-2026-112085 · Updated 2026-10-22T15:25:10.067
Red Hat · CVE-2026-112085 · Updated 2026-10-22T20:16:58+00:00 - https://access.redhat.com/security/cve/CVE-2026-112085 Red Hat · CVE-2026-112085 · Updated 2026-10-22T20:16:58+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2558804 Red Hat · CVE-2026-112085 · Updated 2026-10-22T20:16:58+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-112085 Red Hat · CVE-2026-112085 · Updated 2026-10-22T20:16:58+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-112085 Red Hat · CVE-2026-112085 · Updated 2026-10-22T20:16:58+00:00