---
title: "CVE-2026-9595\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-9595?format=md
keywords: index, follow
---

# CVE-2026-9595

Publication date 15 June 2026

Last updated 25 June 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**5.3 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2026-9595?format=md#impact-score)

Toggle side navigation

## Description

Impact: When a user-configured proxy on webpack-dev-server has a broad
context (e.g. /) and ws: true, it also intercepts the dev server's own HMR
WebSocket and forwards it to the proxy target. This leaks the browser's
cookies and Origin header to the backend, bypasses the dev server's
Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy
end up writing to the same socket).
Patches: Fixed in webpack-dev-server@5.2.5.
Workarounds: Scope user-defined proxy context to specific paths instead of
/, or omit ws: true from the proxy entry when WebSocket forwarding is not
required.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| node-webpack | 26.04 LTS resolute | Needs evaluation |
| 25.10 questing | Ignored end of life, was needs-triage |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |
| 18.04 LTS bionic | Needs evaluation |
| vue.js | 26.04 LTS resolute | Needs evaluation |
| 25.10 questing | Ignored end of life, was needs-triage |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

5.3 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | Low |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 5.3 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9595)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-9595)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-9595)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-9595)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-9595>
* <https://cna.openjsf.org/security-advisories.html>
* <https://github.com/facebook/create-react-app/pull/7444>
* <https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb>
* <https://github.com/webpack/webpack-dev-server/pull/4316>
* <https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79>