CVE-2026-14620: webpack webpack-dev-server CSRF in developer endpoints

CVE-2026-14620 · Severity: medium · CVSS 4.7 · Published 2026-07-03

A vulnerability in the webpack-dev-server, a tool used by developers to preview web applications, allows malicious websites to interfere with a developer's local machine. If a developer visits a compromised site while the server is running, an attacker can force the developer's code editor to open sensitive local files or repeatedly trigger resource-intensive tasks. This can lead to a loss of productivity and potential exposure of local file paths, though the actual content of the files is not directly sent to the attacker.

Technologies: webpack-dev-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-14620 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-14620 being exploited in the wild.
How severe is CVE-2026-14620?
Medium severity, with a CVSS score of 4.7, published 3 July 2026.
Which products and versions are affected?
webpack-dev-server (npm) <= 5.2.5, SEMVER:introduced=0,fixed=5.2.6.
Is there a fix for CVE-2026-14620?
Yes. webpack-dev-server (npm): upgrade to 5.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14620 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-14620?
Check whether you run webpack-dev-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • webpack-dev-server (npm): upgrade to 5.2.6 or later
    npm install webpack-dev-server@5.2.6

Technical details

The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints in webpack-dev-server perform state-changing actions upon receiving HTTP GET requests without implementing CSRF protections. Because these endpoints do not verify the origin of the request, a remote attacker can use a malicious website to trigger these actions via a developer's browser. An exploit can force the developer's local editor to open arbitrary files (including those outside the project root like SSH configs) or trigger repeated recompilations and process spawning to cause a Denial of Service (DoS) on the developer's machine. The issue is fixed in version 5.2.6 by rejecting cross-site requests to these endpoints.

Affected products

  • webpack webpack-dev-server <= 5.2.5

Identifiers

  • CVE-2026-14620
  • GHSA-f5vj-f2hx-8m93

Timeline

  • 2026-07-03: disclosed
  • 2026-07-20: advisory: GitHub Advisory published
  • 2026-07-20: patched: Fixed in version 5.2.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.