Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it     also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the     browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and     corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in     webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or     omit ws: true from the proxy entry when WebSocket forwarding is not required. (CVE-2026-9595)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it
    also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the
    browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and
    corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in
    webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or
    omit ws: true from the proxy entry when WebSocket forwarding is not required. (CVE-2026-9595)

ID	Name	Product	Family	Severity
322466	Linux Distros Unpatched Vulnerability : CVE-2026-9595	Nessus	Misc.	medium
443351	SCA: security update for webpack-dev-server (GHSA-mx8g-39q3-5c79)	Tenable Cloud Security	SCA Checks	medium
443351	SCA: security update for webpack-dev-server (GHSA-mx8g-39q3-5c79)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-9595

medium

Tenable Plugins

medium

medium

medium