webpack-dev-server denial of service via malformed Host/Origin header

webpack-dev-server is the *local development* HTTP server bundled with the webpack toolchain. It listens on localhost:8080 (or a developer-chosen port) while a frontend engineer is actively editing code, serving hot-reloaded JS/CSS bundles to their browser. CVE-2026-14631 describes a CWE-20 improper input validation flaw in the Host/Origin header parsing path: a malformed header value triggers an unhandled exception inside the dev-server's request middleware, terminating the Node.js process. Affected versions per the advisory chain cover webpack-dev-server 4.x prior to the patched 4.15.2 line and 5.x prior to 5.2.1; the fix is a defensive try/catch around the header normalization routine.

The vendor MEDIUM (5.3) rating uses AV:N/AC:L/PR:N/UI:N/A:L — network-reachable, unauth, low complexity, availability-only. Mechanically the vector is correct. Contextually it is overstated. webpack-dev-server is explicitly documented as a *development-time* tool; the maintainers have said for years that it is not hardened for production or hostile-network exposure. The realistic impact is: an attacker on the same LAN as a developer crashes the developer's hot-reload server, forcing an npm run dev restart. There is no confidentiality loss, no integrity loss, no lateral movement, and no persistence. This is a nuisance, not a security event.

Sources.

1. webpack-dev-server GHSA index
2. GHSA-9jgg-88mc-972h — prior wds Host/Origin advisory (context)
3. GHSA-79cf-xcqc-c78w — related cross-origin advisory
4. webpack-dev-server issue #1604 — Invalid Host/Origin warning
5. webpack-dev-server issue #3997 — HTTPS disconnect on bad header
6. Snyk package page for webpack-dev-server
7. OSV entry for related wds advisory
8. IBM security bulletin referencing wds CVEs

Run on any Linux/macOS developer workstation or CI runner that contains a package-lock.json / yarn.lock / pnpm-lock.yaml. Invoke as ./check-wds.sh /path/to/repo (defaults to the current directory). No elevated privileges required — this is a lockfile grep, not a network probe.

#!/usr/bin/env bash
# noisgate: webpack-dev-server CVE-2026-14631 lockfile check
# Usage: ./check-wds.sh [repo-root]
set -u
ROOT="${1:-.}"
cd "$ROOT" 2>/dev/null || { echo "UNKNOWN: cannot cd to $ROOT"; exit 2; }

# Find every lockfile in the tree (monorepo-safe)
mapfile -t LOCKS < <(find . -type f \( -name 'package-lock.json' -o -name 'yarn.lock' -o -name 'pnpm-lock.yaml' \) -not -path '*/node_modules/*')

if [ "${#LOCKS[@]}" -eq 0 ]; then
  echo "UNKNOWN: no lockfiles found under $ROOT"
  exit 2
fi

vuln=0
found=0
for lf in "${LOCKS[@]}"; do
  # Extract every webpack-dev-server version pinned in the lockfile
  vers=$(grep -E 'webpack-dev-server' "$lf" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
  for v in $vers; do
    found=1
    IFS='.' read -r MA MI PA <<<"$v"
    # Vulnerable ranges: <4.15.2 OR 5.0.0-5.2.0
    if [ "$MA" -lt 4 ]; then
      echo "VULNERABLE: $lf pins webpack-dev-server $v (<4.15.2)"; vuln=1
    elif [ "$MA" -eq 4 ] && { [ "$MI" -lt 15 ] || { [ "$MI" -eq 15 ] && [ "$PA" -lt 2 ]; }; }; then
      echo "VULNERABLE: $lf pins webpack-dev-server $v (<4.15.2)"; vuln=1
    elif [ "$MA" -eq 5 ] && { [ "$MI" -lt 2 ] || { [ "$MI" -eq 2 ] && [ "$PA" -lt 1 ]; }; }; then
      echo "VULNERABLE: $lf pins webpack-dev-server $v (<5.2.1)"; vuln=1
    else
      echo "PATCHED: $lf pins webpack-dev-server $v"
    fi
  done
done

if [ "$found" -eq 0 ]; then echo "PATCHED: webpack-dev-server not present"; exit 0; fi
exit $vuln