Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

webpack/webpack-dev-server

              main @ c3ee325
            

Fixes

CVEs

CRITICAL

Peak severity

73.3%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

lib/Server.js: most-fixed (22 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site WebSocket Hijacking: Incomplete verification of incoming request headers allows cross-origin sites to initiate unauthorized WebSocket sessions to the dev server, leading to potential source code exposure. Proper routing of headers to verification hooks and strict validation of Origin are essential.

Auth Bypass: Flaws in Host/Origin comparison logics, including improper normalization of IPv6 addresses, broken CLI array parsing, missing header policies, and parser-bypassing URI schemes, have repeatedly allowed attackers to bypass the 'allowedHosts' firewall.

Remote Code Execution: The client-side console/overlay component executed serialized overlay filter strings using the unsafe 'new Function' constructor. This allows any attacker capable of spoofing/compromising socket options to run arbitrary client-side code.