webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - webpack-dev-server allows users to use webpack with a development server that provides live reloading.
    Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious     web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket     hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP     address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An     attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1     contains a patch for the issue. (CVE-2025-30360)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - webpack-dev-server allows users to use webpack with a development server that provides live reloading.
    Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious
    web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket
    hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP
    address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An
    attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1
    contains a patch for the issue. (CVE-2025-30360)

ID	Name	Product	Family	Severity
264716	Linux Distros Unpatched Vulnerability : CVE-2025-30360	Nessus	Misc.	medium
427835	SCA: security update for webpack-dev-server (GHSA-9jgg-88mc-972h)	Tenable Cloud Security	SCA Checks	medium
427835	SCA: security update for webpack-dev-server (GHSA-9jgg-88mc-972h)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-30360

medium

Tenable Plugins

medium

medium

medium