CVE-2026-14620
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
- Record
CVE-2026-14620- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L - Weakness
- CWE-352, CWE-749
- Updated
- 2026-11-02
EUVDEUVD-2026-41558
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
- Record
EUVD-2026-41558- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f5vj-f2hx-8m93
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Impact
The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.
An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.
Patches
Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #5698).
Workarounds
None
- Record
GHSA-f5vj-f2hx-8m93- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L - Weakness
- CWE-352, CWE-749
- Updated
- 2026-11-02
NVD
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
- Record
CVE-2026-14620- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L - Weakness
- CWE-352, CWE-749
- Updated
- 2026-11-02
OSV
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
- Record
CVE-2026-14620- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L - Weakness
- CWE-352, CWE-749
- Updated
- 2026-11-02
OSVGHSA-f5vj-f2hx-8m93
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Impact
The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.
An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.
Patches
Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #5698).
Workarounds
None
- Record
GHSA-f5vj-f2hx-8m93- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L - Weakness
- CWE-352, CWE-749
- Updated
- 2026-11-02
Show 10 moreShow less
OSVCLSA-2026-1784596297 No score
TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.2-tuxcare.2.
- Record
CLSA-2026-1784596297- Updated
- 2026-11-02
OSVCLSA-2026-1786365627 No score
TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.1-tuxcare.4.
- Record
CLSA-2026-1786365627- Updated
- 2026-11-02
OSVCLSA-2026-1787837465 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4.
- Record
CLSA-2026-1787837465- Updated
- 2026-11-02
OSVCLSA-2026-1790004677 No score
TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2.
- Record
CLSA-2026-1790004677- Updated
- 2026-11-02
OSVCLSA-2026-1790863106 No score
TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 5.2.5-tuxcare.1.
- Record
CLSA-2026-1790863106- Updated
- 2026-11-02
OSVCLSA-2026-1790944348 No score
TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.9.3-tuxcare.2.
- Record
CLSA-2026-1790944348- Updated
- 2026-11-02
OSVCLSA-2026-1793836056 No score
TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.11.3-tuxcare.6.
- Record
CLSA-2026-1793836056- Updated
- 2026-11-05
OSVCLSA-2026-1793867542 No score
TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.11.0-tuxcare.8.
- Record
CLSA-2026-1793867542- Updated
- 2026-11-05
OSVCLSA-2026-1793874424 No score
TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.11.2-tuxcare.6.
- Record
CLSA-2026-1793874424- Updated
- 2026-11-05
OSVROOT-APP-NPM-CVE-2026-14620 No score
CVE-2026-14620 in webpack-dev-server - Patched by Root
Root has patched CVE-2026-14620 in the webpack-dev-server package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-14620- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webpack-dev-servernpm |
through 5.2.5 | 5.2.6 |
webpack-dev-serverTuxCare:npm From an advisory covering 2 CVEs |
4.15.2-tuxcare.0 up to 4.15.2-tuxcare.2, plus listed versions 4.15.24.15.2-tuxcare.1 |
4.15.2-tuxcare.2 |
webpack-dev-serverTuxCare:npm From an advisory covering 2 CVEs |
4.15.1-tuxcare.0 up to 4.15.1-tuxcare.4, plus listed versions 4.15.14.15.1-tuxcare.14.15.1-tuxcare.24.15.1-tuxcare.3 |
4.15.1-tuxcare.4 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
4.11.1-tuxcare.0 up to 4.11.1-tuxcare.4, plus listed versions 4.11.14.11.1-tuxcare.14.11.1-tuxcare.24.11.1-tuxcare.3 |
4.11.1-tuxcare.4 |
webpack-dev-serverTuxCare:npm From an advisory covering 3 CVEs |
5.2.2-tuxcare.0 up to 5.2.2-tuxcare.2, plus listed versions 5.2.25.2.2-tuxcare.1 |
5.2.2-tuxcare.2 |
webpack-dev-serverTuxCare:npm From an advisory covering 2 CVEs |
5.2.5-tuxcare.0 up to 5.2.5-tuxcare.1, plus listed versions 5.2.5 |
5.2.5-tuxcare.1 |
webpack-dev-serverTuxCare:npm From an advisory covering 2 CVEs |
4.9.3-tuxcare.0 up to 4.9.3-tuxcare.2, plus listed versions 4.9.34.9.3-tuxcare.1 |
4.9.3-tuxcare.2 |
webpack-dev-serverTuxCare:npm |
3.11.3-tuxcare.0 up to 3.11.3-tuxcare.6, plus listed versions 3.11.33.11.3-tuxcare.13.11.3-tuxcare.23.11.3-tuxcare.33.11.3-tuxcare.43.11.3-tuxcare.5 |
3.11.3-tuxcare.6 |
webpack-dev-serverTuxCare:npm |
3.11.0-tuxcare.0 up to 3.11.0-tuxcare.8, plus listed versions 3.11.03.11.0-tuxcare.13.11.0-tuxcare.23.11.0-tuxcare.33.11.0-tuxcare.43.11.0-tuxcare.53.11.0-tuxcare.63.11.0-tuxcare.7 |
3.11.0-tuxcare.8 |
webpack-dev-serverTuxCare:npm |
3.11.2-tuxcare.0 up to 3.11.2-tuxcare.6, plus listed versions 3.11.23.11.2-tuxcare.13.11.2-tuxcare.23.11.2-tuxcare.33.11.2-tuxcare.43.11.2-tuxcare.5 |
3.11.2-tuxcare.6 |
webpack-dev-servernpm |
before 5.2.6 | 5.2.6 |
webpack-dev-serverRoot:npm |
before 5.2.2-aikido.3 | 5.2.2-aikido.35.2.3-aikido.35.0.4-aikido.25.2.4-aikido.23.11.3-aikido.44.10.0-aikido.3 |
@rootio/webpack-dev-serverRoot:npm |
before 5.2.2-root.io.3 | 5.2.2-root.io.35.2.3-root.io.35.0.4-root.io.25.2.4-root.io.23.11.3-root.io.44.10.0-root.io.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | webpack_devserver 5.2.5 - CSRF | 2026-08-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-14620 is a medium vulnerability (CVSS 4.7) in Webpack-dev-server, published July 3, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in webpack-dev-server 5.2.6.
References
github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93
cna.openjsf.org/security-advisories.html
nvd.nist.gov/vuln/detail/CVE-2026-14620