VDB
RHSA-2026:51038
RHSA-2026:51038
PUBLISHED
CVSS 8.5 HIGH
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket (ws: true) forwarding, the development server's own Hot Module Replacement (HMR) WebSocket can be intercepted. This interception leads to the leakage of the browser's cookies and Origin header to the proxy target, bypassing the server's Host/Origin validation. Additionally, it can corrupt the HMR socket, resulting in a denial of service for the HMR functionality.
Risk Scores
CVSS 3.1
8.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:2556be4b8b83c40682ff3b606b7582296b8d16673d047aa63bd33eec7c75313e_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:701fbd512a863b227f08619ab90147552f5dbb72a4bf0f3300e8847f5766a33e_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:b86079ed5b1ae64b0b00529343c67be4680cddfb1b176aa7ed48624b4e54c83d_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-apiserver-rhel9@sha256:597335c6eb655689ae85fd4fcdbff74cbffaa4ae6ee205e9b6aad00c0818fbe9_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-monitoring-rhel9-operator@sha256:41266f3fb72f7ca4af4960ed98c661cfd4a3641a41751459d199fda0cdbbae44_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-policy-controller-rhel9@sha256:933617e48a522117f83e532ee01b28ecb10801363d335455d9dddc544ac59343_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:cda7b537c6d304735feb70e5fefee7e10fa33c0f3c42035e6ce477a7707dd382_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel9@sha256:db927c9e4d07c41cdc80366b7362ac9b2c207975777577209be248a3bb61607e_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel9@sha256:9379104584170157aec016e0b65010d32aedec28abd57c9e77ed551ca6569f62_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-network-interface-bond-cni-rhel9@sha256:d46a8c485e8b2df2233033e163ad9d5feadcf7d9380922eb91faecf8c337f474_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-tools-rhel9@sha256:d8347bc4ce4f2007750799a337bc1ef131a8dc3b3a2d441a7c7a0eccc29bf3c4_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9-operator@sha256:53bee70e3ae0340388974e89de4877ca15c54f7f745b5d8e04e24763367f38fa_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f75db69d531feccdc49ff1d2a8299a4bb292c6c54b4222a2ae9888d06abd4fe0_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-state-metrics-rhel9@sha256:876481d0de8df01b30f80b7764e28d180a3b79babfbd969279cb1348173209bf_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel9@sha256:cb4c011a90bbbc72b8c44248242d4bd2c286790b3ddd0fa1c47e5f7abef49118_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-tools-rhel9@sha256:2f63442e2b9dd0519e08e015fd74007d19e23ca891c76d40936f133374cdeeeb_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel9@sha256:d1513eaf01a7eb042e4afb59dfa827629aeb6b23a7a2b65b32bd2f50d49c8708_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9@sha256:1bb11c191c8d1081a428ab555684b504367476f9f15de2c745ab239eccdb9d14_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-machine-approver-rhel9@sha256:dfe0aacc569cd61d823ed7242b46b41d057fd1d348bbece001ac2c0db75843e5_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-rhel9-operator@sha256:8e4b859fcd4c6722ec6a466712597ff256099f3e0c415e6c6abfbcd5b76739ed_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
…and 635 more
Timeline
- Aug 11, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:51038 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-39828 advisory
- https://access.redhat.com/security/cve/CVE-2026-39835 advisory
- https://access.redhat.com/security/cve/CVE-2026-43003 advisory
- https://access.redhat.com/security/cve/CVE-2026-44918 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-48801 advisory
- https://access.redhat.com/security/cve/CVE-2026-49332 advisory
- https://access.redhat.com/security/cve/CVE-2026-9595 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51038.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2488934 issue
- https://www.cve.org/CVERecord?id=CVE-2026-9595 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9595 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/facebook/create-react-app/pull/7444 advisory
- https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb advisory
- https://github.com/webpack/webpack-dev-server/pull/4316 advisory
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79 advisory
…and 44 more