react-scripts/ webpack-dev-server

[hilalevx]

I'm using [email protected], which is locked to [email protected].
A vulnerability was found: CVE-2025-30360
While webpack5.2.1 fixes the CVE (using override), the upgrade doesn't let me run the app. I get this error on npm start:
Invalid options object. Dev Server has been initialized using an options object that does not match the API schema.
options has an unknown property 'onAfterSetupMiddleware'. These properties are valid:
object { allowedHosts?, bonjour?, client?, compress?, devMiddleware?, headers?, historyApiFallback?, host?, hot?, ipc?, liveReload?, onListening?, open?, port?, proxy?, server?, app?, setupExitSignals?, setupMiddlewares?, static?, watchFiles?, webSocketServer? }

any solutions?

[alexander-akait]

Unfortunately react-scripts is not supported webpack-dev-server@5, we are preparing security fixes for v4

[pakkeer12]

@alexander-akait, any update ?

[vakulinina]

@alexander-akait bump and thanks in advance

[haicaumuoi]

@alexander-akait bump and thanks in advance

[mikeCapozziICF]

@alexander-akait any update? Unfortunately we are unable to move away from react-scripts at this time and need to be able to build locally. I believe @Wajih-Ul-Hasan said he had a PR for this already. Are security fixes still on the table for version 4? Thank you!

[malcomio]

see webpack/webpack-dev-server#5515 and webpack/webpack-dev-server#5514

[Wajih-Ul-Hasan]

@alexander-akait can you provide the any alternative to resolve this issue we need to fix it for our client by the end of the next Monday.

[alexander-akait]

You can send a PR with backporting fixes to v4, I am planning to do it, but can't find time right now

[Wajih-Ul-Hasan]

@alexander-akait PR created with backporting fixes to v4.

[mikeCapozziICF]

Thanks @Wajih-Ul-Hasan ! @alexander-akait , it this PR being considered for a potential version 4 update? The problem we have, is we cannot override to webpack-dev-server 5.2.2 because of the config-override changes in format that react-scripts uses. It causes our build to fail. The vulnerability, while I realize is dev env only, is something we really want to get cleaned up for our client. Thanks so much for discussing this!

[Wajih-Ul-Hasan]

@alexander-akait I simply override "webpack-dev-server" to version "^5.2.2", and it fixed my issue. Since webpack-dev-server is only used for local development, and production environments serve only static files, this override does not affect the app’s behavior in production — at least as far as I understand it.

[alexander-akait]

Yeah, webpack-dev-server is only for development env

[DannyMeister]

But it breaks the ability to run the dev server for the developers local environments. Is there a link for us to track v4 progress?

[causztic]

I patched it manually for my own repo: facebook/create-react-app#17095 (comment) if yall need an alternative @DannyMeister @mikeCapozziICF