https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-14631.htmlhttps://patchthecve.com/cve/CVE-2026-14631.htmlTue, 07 Jul 2026 15:08:59 +0000MEDIUM 5.3: webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exchttps://patchthecve.com/cve/CVE-2026-14620.htmlhttps://patchthecve.com/cve/CVE-2026-14620.htmlTue, 07 Jul 2026 15:12:43 +0000MEDIUM 4.7: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website https://patchthecve.com/cve/CVE-2026-9595.htmlhttps://patchthecve.com/cve/CVE-2026-9595.htmlWed, 17 Jun 2026 11:05:31 +0000MEDIUM 5.3: Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin va