2026/5/11 -Impact. When webpack-dev-server is running on a non-HTTPS origin (the default), cross-origin requests from malicious websites can load the dev server's ...
2026/10/18 -Use webpack with a development server that provides live reloading. This should be used for development only. It uses webpack-dev-middleware under the hood, ...
2026/7/3 -Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/ ...
2026/10/22 -webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy ...
2026/7/20 -An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, ...
2026/8/17 -Exploit Title: webpack_devserver 5.2.5 - Csrf # Date: 2026-07-17 # Exploit Author: Pig-Tail (Jorge González Milla) # Vendor Homepage: ...
2026/9/10 -Serving the dev server over HTTPS is a documented workaround rather than a substitute for upgrading. Then 5.2.5 fixed CVE-2026-9595, where a broadly scoped ...
2026/7/24 -webpack is a module bundler for JavaScript, CSS, HTML, WebAssembly and assets. It builds a dependency graph from your project and emits optimized bundles ...
2026/7/3 -Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can ...
2026/6/28 -Webpack is a monolithic bundler that contains all its own build machinery, whereas Vite is a dev server that delegates its underlying compilation to esbuild.