CVE-2026-9595

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

• CWE-346
• CWE-441

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/facebook/create-react-app/pull/7444Issue Tracking, Patch
• https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcbPatch
• https://github.com/webpack/webpack-dev-server/pull/4316Issue Tracking, Patch
• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79Mitigation, Vendor Advisory

Published

Jun 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-95927A vulnerability was identified in SourceCodester Online Revi…7.3
• CVE-2026-95928A security flaw has been discovered in recommenders-team rec…5.5
• CVE-2026-95929A weakness has been identified in iFlytek astron-agent up to…6.3
• CVE-2026-9593A vulnerability in the iDTM FDI allows an attacker with elev…6.7
• CVE-2026-95930A security vulnerability has been detected in iFlytek astron…6.3
• CVE-2026-9594The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator…4.4
• CVE-2026-95957A vulnerability was found in SourceCodester Smart Attendance…4.3
• CVE-2026-95958A security flaw has been discovered in JusticeRage Manalyze …3.3
• CVE-2026-9597Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail …5.4
• CVE-2026-95985The file write tool in Amazon Kiro IDE versions before 1.0.2…8.8
• CVE-2026-9599The Tectite Forms plugin for WordPress is vulnerable to Cros…4.3
• CVE-2026-9602Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to…6.5