# webpack-dev-server v5.2.6

- Product: webpack-dev-server (https://whatsnew.fyi/product/webpack-dev-server)
- Vendor: webpack
- Date: 2026-07-02
- Version: v5.2.6
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.2.6

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Allow `undefined` as the `Server` constructor `options` argument, defaulting it to `{}`
- **security** — Protect the built-in state-changing routes (`/webpack-dev-server/invalidate` and `/webpack-dev-server/open-editor`) against cross-site request forgery by checking requests with `Sec-Fetch-Site` header or `Origin`/`Host` comparison
- **fixed** — Handle malformed `Host` and `Origin` header values gracefully when validating requests

###### Patch Changes

- fix: allow `undefined` as the `Server` constructor `options` argument again (by [@bjohansebas](https://github.com/bjohansebas) in [#5695](https://github.com/webpack/webpack-dev-server/pull/5695))

  Restores accepting `undefined` (defaulting it to `{}`) for the `options`
  argument, so passing a webpack config's optional `devServer` field type-checks and works as before.

- Protect the built-in state-changing routes (`/webpack-dev-server/invalidate` and `/webpack-dev-server/open-editor`) against cross-site request forgery. Requests are now checked with `Sec-Fetch-Site` (falling back to an `Origin`/`Host` comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by [@bjohansebas](https://github.com/bjohansebas) in [#5698](https://github.com/webpack/webpack-dev-server/pull/5698))

- Handle malformed `Host` and `Origin` header values gracefully when validating requests. (by [@bjohansebas](https://github.com/bjohansebas) in [#5699](https://github.com/webpack/webpack-dev-server/pull/5699))