CVE-2026-6402
published 2026-05-12CVE-2026-6402: webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy…
PriorityP344medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EXPLOIT
EPSS
0.29%
21.1th percentile
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| clusterlabs | pcs | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| discovery | discovery-ui-rhel9 | — | — |
| gatekeeper | gatekeeper-rhel9 | — | — |
| grafana | grafana | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-pf5-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel8 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel9 | — | — |
| openshift-pipelines | pipelines-hub-ui-rhel8 | — | — |
| openshift-pipelines | pipelines-hub-ui-rhel9 | — | — |
| openshift-service-mesh | kiali-operator-bundle | — | — |
| openshift-service-mesh | kiali-ossmc-rhel8 | — | — |
| openshift-service-mesh | kiali-ossmc-rhel9 | — | — |
| openshift-service-mesh | kiali-rhel8 | — | — |
| openshift-service-mesh | kiali-rhel9 | — | — |
| openshift-service-mesh | kiali-rhel9-operator | — | — |
| openshift4 | ose-console-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
ghsa5.9MEDIUM
vendor_redhat5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
webpack-dev-server up to 5.2.3 routine (GHSA-79cf-xcqc-c78w / EUVD-2026-29404)
vuldb·2026-05-19·CVSS 6.5
CVE-2026-6402 [MEDIUM] webpack-dev-server up to 5.2.3 routine (GHSA-79cf-xcqc-c78w / EUVD-2026-29404)
A vulnerability was found in webpack-dev-server up to 5.2.3. It has been classified as problematic. This affects an unknown part. The manipulation leads to exposed dangerous routine.
This vulnerability is traded as CVE-2026-6402. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
ghsa·2026-05-18·CVSS 5.9
CVE-2026-6402 [MEDIUM] CWE-749 webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
### Impact
When webpack-dev-server is running on a non-HTTPS origin (the default), cross-origin requests from malicious websites can load the dev server's JavaScript bundles via `` tags. The fix introduced in v5.2.1 (CVE-2025-30359) relied on `Sec-Fetch-Mode` and `Sec-Fetch-Site` request headers to block these requests, but browsers only send these headers for [potentially trustworthy origins](https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy). Over plain HTTP, the headers are absent and the check is bypassed.
An attacker who knows the dev server's host, port, and output path can exfiltrate all module source code by intercepting the webpack runtime's module registration.
This do
Red Hat
webpack-dev-server: webpack-dev-server: Information disclosure due to cross-origin source code exposure
vendor_redhat·2026-05-12·CVSS 5.3
CVE-2026-6402 [MEDIUM] CWE-346 webpack-dev-server: webpack-dev-server: Information disclosure due to cross-origin source code exposure
webpack-dev-server: webpack-dev-server: Information disclosure due to cross-origin source code exposure
A flaw was found in webpack-dev-server. When the development server operates over plain HTTP, a remote attacker can exploit a cross-origin source code exposure vulnerability. This allows a malicious website, visited by a developer, to load the bundled application source code as a script and read it across origins. Consequently, this could lead to the disclosure of sensitive application source code.
Package: cryostat-openshift-console-plugin-npm (Cryostat 4) - Fix deferred
Package: webpack-dev-server (Cryostat 4) - Fix deferred
Package: gatekeeper/gatekeeper-rhel9 (Gatekeeper 3) - Fix deferred
Package: rhmtc/openshift-migration-ui-rhel8 (Migration Toolkit for Containers) - Fix deferr
No detection rules found.
2026-05-12
Published