Update dependency webpack-dev-server to v5.2.6 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
webpack-dev-server	5.2.5 → 5.2.6

---

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

CVE-2026-14631 / GHSA-m28w-2pqf-7qgj

More information

Details

Impact

An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.

Patches

Fixed in webpack-dev-server 5.2.6 by treating malformed Host and Origin header values as invalid rather than throwing (see PR #​5699).

Workarounds

Keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-m28w-2pqf-7qgj
• https://nvd.nist.gov/vuln/detail/CVE-2026-14631
• https://github.com/webpack/webpack-dev-server/pull/5699
• https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-m28w-2pqf-7qgj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

CVE-2026-14620 / GHSA-f5vj-f2hx-8m93

More information

Details

Impact

The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.

An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.

Patches

Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #​5698).

Workarounds

None

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93
• https://nvd.nist.gov/vuln/detail/CVE-2026-14620
• https://github.com/webpack/webpack-dev-server/pull/5698
• https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c
• https://cna.openjsf.org/security-advisories.html
• https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6
• https://github.com/advisories/GHSA-f5vj-f2hx-8m93

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

webpack/webpack-dev-server (webpack-dev-server)

v5.2.6

Compare Source

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #​5695)

  Restores accepting undefined (defaulting it to {}) for the options
  argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #​5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #​5699)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 48.22%. Comparing base (9934506) to head (932ca67).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5126   +/-   ##
=======================================
  Coverage   48.22%   48.22%           
=======================================
  Files         827      827           
  Lines       34120    34120           
  Branches     5837     5837           
=======================================
  Hits        16455    16455           
  Misses      15781    15781           
  Partials     1884     1884           

Flag	Coverage Δ
api-python	93.25% <ø> (ø)
catalog	25.18% <ø> (ø)
lambda	85.38% <ø> (ø)
py-shared	98.02% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.