webpack

react-scripts/ webpack-dev-server#19599

Unanswered

hilalevx asked this question inQ&A

react-scripts/ webpack-dev-server#19599

hilalevx

Jun 10, 2025

· 4 comments· 15 replies

Return to top

Discussion options

hilalevx
Jun 10, 2025

I'm using react-scripts@5.0.1, which is locked towebpack-dev-server@4.x.
A vulnerability was found:CVE-2025-30360
While webpack5.2.1 fixes the CVE (using override), the upgrade doesn't let me run the app. I get this error on npm start:
Invalid options object. Dev Server has been initialized using an options object that does not match the API schema.
options has an unknown property 'onAfterSetupMiddleware'. These properties are valid:
object { allowedHosts?, bonjour?, client?, compress?, devMiddleware?, headers?, historyApiFallback?, host?, hot?, ipc?, liveReload?, onListening?, open?, port?, proxy?, server?, app?, setupExitSignals?, setupMiddlewares?, static?, watchFiles?, webSocketServer? }

any solutions?

You must be logged in to vote

Replies: 4 comments 15 replies

Comment options

alexander-akait
Jun 10, 2025
Maintainer

Unfortunatelyreact-scripts is not supported webpack-dev-server@5, we are preparing security fixes for v4

You must be logged in to vote

10 replies

Comment options

pakkeer12 Jul 23, 2025

@alexander-akait, any update ?

Comment options

vakulinina Jul 28, 2025

@alexander-akait bump and thanks in advance

Comment options

haicaumuoi Jul 29, 2025

@alexander-akait bump and thanks in advance

Comment options

mikeCapozziICF Aug 1, 2025

@alexander-akait any update? Unfortunately we are unable to move away from react-scripts at this time and need to be able to build locally. I believe@Wajih-Ul-Hasan said he had a PR for this already. Are security fixes still on the table for version 4? Thank you!

Comment options

malcomio Aug 12, 2025

seewebpack/webpack-dev-server#5515 andwebpack/webpack-dev-server#5514

Comment options

Wajih-Ul-Hasan
Jul 10, 2025

@alexander-akait can you provide the any alternative to resolve this issue we need to fix it for our client by the end of the next Monday.

You must be logged in to vote

3 replies

Comment options

alexander-akait Jul 10, 2025
Maintainer

You can send a PR with backporting fixes to v4, I am planning to do it, but can't find time right now

Comment options

Wajih-Ul-Hasan Jul 11, 2025

@alexander-akait PR created with backporting fixes to v4.

Comment options

mikeCapozziICF Jul 21, 2025

Thanks@Wajih-Ul-Hasan !@alexander-akait , it this PR being considered for a potential version 4 update? The problem we have, is we cannot override to webpack-dev-server 5.2.2 because of the config-override changes in format that react-scripts uses. It causes our build to fail. The vulnerability, while I realize is dev env only, is something we really want to get cleaned up for our client. Thanks so much for discussing this!

Comment options

Wajih-Ul-Hasan
Jul 14, 2025

@alexander-akait I simply override "webpack-dev-server" to version "^5.2.2", and it fixed my issue. Since webpack-dev-server is only used for local development, and production environments serve only static files, this override does not affect the app’s behavior in production — at least as far as I understand it.

You must be logged in to vote

2 replies

Comment options