Fix security issues reported by Dependabot for version 4#5514

kretajak · 2025-06-06T12:52:19Z

For Bugs and Features; did you add new tests?

Fixes Security issues present in version 4 of webpack-dev-server. Similar fixes were already merged into version 5 of webpack-dev-server.

Motivation / Use-Case

Fix issues reported by Dependabot:

Breaking Changes

It is breaking change but it's security wise. Similar changes are already in 5.x.x branch. See commits d2575ad and 5c9378b

Additional Info

…lowed to connect to WebSocket

alexander-akait · 2025-06-06T13:59:18Z

lib/Server.js

+constheaders=
+/** @type{{[key: string]: string | undefined }} */
+(req.headers);
+if(


Recently we added some fixes here to skip check for allowedHost, please add it here

It seems not that straightforward. To me bigger effort is needed to incorporate changes from 03d1214. This PR uses functions defined in previous commits not available in line 4.
If it's not a problem, I would consider merging this PR and creating separate PR for task you mentioned.

@kretajak let's include 03d1214 here, otherwise in some cases it will be impossible to setup a new version and we can merge

@kretajak let me know if you need help backporting that commit. I could try to add it on top of your existing PR if you don't have time to. We have at least 3 Docusaurus issues asking us to solve this security warning so happy to help and get this solved asap.

I'm currently trying to backport that commit. I'll inform you whether I was able to make it.

I have added new commit which should move us a bit closer. Seems like also changes from 6045b1e might be required as they are tightly connected to 03d1214.
@slorber feel free to continue the work.

slorber · 2025-06-06T21:18:49Z

Thanks, we'd also appreciate a backport for Docusaurus because our current minor supports Node 18.0, incompatible with dev server v5, and all newly initialized Docusaurus sites will get dev server v4.

We could bump to the latest Node 18 like Astro did recently (since it reached end of life) but if it's possible to avoid that it's better to not force our users to upgrade Node.js when upgrading a minor version (and I'd rather not release a new major version just for that security fix)

facebook/docusaurus#11252 (comment)

pikachugb · 2025-06-11T10:41:12Z

Hello :) Is there an ETA for the release of potentially version 4.15.3 with the changes from this PR?

linux-foundation-easycla · 2025-06-11T12:44:19Z

The committers listed above are authorized under a signed CLA.

✅ login: sapphi-red / name: 翠 (5ba835f, ba2e692)
✅ login: alexander-akait / name: Alexander Akait (8de7782)

kretajak · 2025-06-11T12:51:41Z

lib/Server.js

+hostname==="localhost"||
+hostname.endsWith(".localhost")||
+hostname===this.options.host
+ : true;


I believe there is a bug in version 5 of weboack-dev-server. false is returned there, but my guess is that when validateHost is false we should bypass checking and return true here.
Above function when called: isValidHost({host: '127.0.0.1 }, 'host', validateHost = false) return false while it should return true. I assume that is the reason so many tests of 6045b1e were changed.

@kretajak it is not a bug, because 127.0.0.1 can be used for attack, you should manually set 127.0.0.1 in allowedHosts for CORS requests, i.e. you opened bad-site.com, this this site can try to connect to ws://localhost:3000 and without such headers non chromium and old chromium browsers will connect to your websockets and can take your source code (in some cases)

Okey. I reverted it to false.

alexander-akait · 2025-06-11T15:08:12Z

@kretajak Can you change your email in the last commin, CLA is failed, we can't merge commits without CLA

@pikachugb This week

…ebpack#5510)

kretajak · 2025-06-12T11:40:23Z

I have converted it to draft as it's incomplete.

wissemayadi21 · 2025-06-16T13:26:28Z

hello please when this version will be published ?

dharaneesh127 · 2025-06-17T09:16:41Z

@hiroppy @anshumanv @snitin315 could you guys please review the PR, and if good can it be published ?

kretajak · 2025-06-17T10:07:21Z

As I wrote here: #5514 (comment) backporting these extra changes is not straightforward. I would recommend dropping the last commit and merge this PR with the very first two commits, as they are essentially fixing the security issue.

wissemayadi21 · 2025-06-18T13:05:21Z

that sounds good , we looking forward to get this release.

alexander-akait · 2025-06-20T14:39:22Z

@kretajak Do you need any help with this?

kretajak · 2025-06-23T09:08:51Z

@kretajak Do you need any help with this?

That would be great, if you feel changes from 03d1214 and 6045b1e must be incorporated here.

pikachugb · 2025-07-09T09:05:27Z

Any news on this one? @kretajak @alexander-akait

kretajak · 2025-07-26T20:46:07Z

Hi, I'm not able to continue the effort, as I do not feel confident enough to incorporate changes from 03d1214 and 6045b1e.

hilalevx · 2025-10-15T08:56:53Z

hi :) is there an ETA to the new 4 version release?

sapphi-red added 2 commits June 6, 2025 14:23

fix(security): requests with an IP addresses Origin header are not al…
5ba835f
…lowed to connect to WebSocket

fix(security): check cross origin requests
ba2e692

kretajak requested review from alexander-akait, anshumanv, hiroppy and snitin315 as code owners June 6, 2025 12:52

alexander-akait reviewed Jun 6, 2025
View reviewed changes

slorber mentioned this pull request Jun 6, 2025
chore(deps): bump webpack-dev-server from 4.15.2 to 5.2.1 facebook/docusaurus#11239
Closed

MrBMT mentioned this pull request Jun 9, 2025
Backport security fixes from v5.2.1 to v4 #5515
Open

mertssmnoglu mentioned this pull request Jun 10, 2025
chore(deps): Bump docusaurus to 3.8.1 | WIP ticaretistatistik/ticaretistatistik.github.io#60
Closed

slorber mentioned this pull request Jun 11, 2025
@docusaurus/code latest version used [email protected], which has Security Vulnerability facebook/docusaurus#11256
Closed
7 tasks

kretajak commented Jun 11, 2025
View reviewed changes

kretajak force-pushed the fix/security-issues branch from 3d925e1 to d6be469Compare June 11, 2025 20:13

alexander-akait approved these changes Jun 12, 2025
View reviewed changes

fix: respect theallowedHostsoption for cross-origin header check (w…
8de7782
…ebpack#5510)

kretajak force-pushed the fix/security-issues branch from d6be469 to 8de7782Compare June 12, 2025 11:39

kretajak marked this pull request as draft June 12, 2025 11:39

levymetal mentioned this pull request Jul 2, 2025
[DO NOT MERGE] Bump webpack-dev-server from 4.15.2 to 5.2.1 in /brain ferocia/kartalytics#152
Closed

alexander-akait mentioned this pull request Jul 11, 2025
Backport security fix from v5.2.1 to version-4 (non-Chromium browser dev-server vulnerability) #5534
Open

JakobLichterfeld mentioned this pull request Jul 18, 2025
sec: bump webpack-dev-server as soon as docusaurus/core and /preset-classic solved their dependencies teslamate-org/teslamate#4832
Open

slorber mentioned this pull request Jul 18, 2025
@docusaurus/preset-classic:3.8.1 uses webpack-dev-server: 4.15.2 which has known security vulnerabilities facebook/docusaurus#11334
Closed
7 tasks

Razican mentioned this pull request Aug 13, 2025
Updated dependencies boa-dev/boa-dev.github.io#204
Merged

This was referenced Sep 12, 2025
chore: drop support for Node 18, that reached End-of-Life facebook/docusaurus#11408
Merged
fix(deps): upgrade webpack-dev-server to v5, fix security warning facebook/docusaurus#11410
Merged

Uh oh!

Fix security issues reported by Dependabot for version 4#5514

Are you sure you want to change the base?

Fix security issues reported by Dependabot for version 4 #5514

Conversation

kretajak commented Jun 6, 2025

For Bugs and Features; did you add new tests?

Motivation / Use-Case

Breaking Changes

Additional Info

Uh oh!

alexander-akaitJun 6, 2025

Choose a reason for hiding this comment

Uh oh!

kretajakJun 9, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexander-akaitJun 10, 2025

Choose a reason for hiding this comment

Uh oh!

slorberJun 11, 2025

Choose a reason for hiding this comment

Uh oh!

kretajakJun 11, 2025

Choose a reason for hiding this comment

Uh oh!

kretajakJun 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

slorber commented Jun 6, 2025

Uh oh!

pikachugb commented Jun 11, 2025

Uh oh!

linux-foundation-easyclabot commented Jun 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kretajakJun 11, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexander-akaitJun 11, 2025

Choose a reason for hiding this comment

Uh oh!

kretajakJun 12, 2025

Choose a reason for hiding this comment

Uh oh!

alexander-akait commented Jun 11, 2025

Uh oh!

kretajak commented Jun 12, 2025

Uh oh!

wissemayadi21 commented Jun 16, 2025

Uh oh!

dharaneesh127 commented Jun 17, 2025

Uh oh!

kretajak commented Jun 17, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wissemayadi21 commented Jun 18, 2025

Uh oh!

alexander-akait commented Jun 20, 2025

Uh oh!

kretajak commented Jun 23, 2025

Uh oh!

pikachugb commented Jul 9, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kretajak commented Jul 26, 2025

Uh oh!

hilalevx commented Oct 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

kretajakJun 9, 2025•
edited
Loading

kretajakJun 11, 2025•
edited
Loading

linux-foundation-easyclabot commented Jun 11, 2025•
edited
Loading

kretajakJun 11, 2025•
edited
Loading

kretajak commented Jun 17, 2025•
edited
Loading

pikachugb commented Jul 9, 2025•
edited
Loading