webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure
    when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the
    Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins,
    allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an
    attacker controlling a website visited by a developer running webpack-dev-server can recover the
    application source code when the dev server runs over HTTP at a guessable host and port. Chromium based
    browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to
    webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.
    (CVE-2026-6402)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure     when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the     Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins,     allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an     attacker controlling a website visited by a developer running webpack-dev-server can recover the     application source code when the dev server runs over HTTP at a guessable host and port. Chromium based     browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to     webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.
    (CVE-2026-6402)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
442083	SCA: security update for webpack-dev-server (GHSA-79cf-xcqc-c78w)	Tenable Cloud Security	SCA Checks	Local	medium
442083	SCA: security update for webpack-dev-server (GHSA-79cf-xcqc-c78w)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
315211	Linux Distros Unpatched Vulnerability : CVE-2026-6402	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-6402

medium

Tenable Plugins

medium

medium

medium