[AppSecAI Agent] webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

[conviso-platform-appsec-staging]

AppSecAI Agent

Issue ID: 1713857
Title: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Severity: MEDIUM
Type: ScaFinding

Description

Impact

An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.

Patches

Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #5699).

Workarounds

Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

Fix Details

Security Fix: Upgrade webpack-dev-server to resolve DoS vulnerability

Summary

This PR addresses a medium-severity security vulnerability in webpack-dev-server (CVE affecting versions prior to 5.2.6) by adding a resolution to enforce the use of a patched version.

Vulnerability Details

• Type: Denial of Service (DoS)
• Package: webpack-dev-server
• Affected Version: < 5.2.6
• Patched Version: >= 5.2.6
• Severity: MEDIUM

Description

An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either:

• A normal HTTP request with a malformed Host header, or
• A WebSocket upgrade to the default /ws endpoint with a malformed Origin header.

The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.

Fix Applied

Added "webpack-dev-server": "^5.2.6" to the resolutions field in package.json. This ensures that all transitive dependencies that pull in webpack-dev-server (including those used by @docusaurus/core and related packages) will use version 5.2.6 or later, which treats malformed Host and Origin header values as invalid rather than throwing an uncaught exception.

References

• webpack-dev-server PR #5699
• Fixed in webpack-dev-server 5.2.6

---

This PR was automatically created by Conviso Platform Auto-Fix.

[conviso-platform-appsec]

Conviso Security Gate — No Security Gate rule configured

No conviso_ast rule and no default rule are configured for this asset or company, so there is no policy to evaluate. Nothing was passed or failed.

No new findings were introduced by this pull request.

View the full run in Conviso