Cross-Origin Request Vulnerability in Webpack-Dev-Server Affects Developers
CVE-2026-14620

4.7MEDIUM

Key Information:

Vendor

Webpack-dev-server

Status
Webpack-dev-server
Vendor
CVE Published:
3 July 2026

What is CVE-2026-14620?

The vulnerability in webpack-dev-server versions 5.2.5 and prior involves two internal endpoints that allow state-changing GET requests without proper request validation. This can enable an attacker to exploit any website the developer visits while the server is running, triggering actions such as opening local files in the developer's editor without consent. This can lead to unauthorized access to arbitrary files and possibly overload the developer's system due to repeated requests causing unwanted recompilations. It is recommended to upgrade to webpack-dev-server version 5.2.6 to mitigate this risk, as there are no known workarounds.

Affected Version(s)

webpack-dev-server 0 < 5.2.6

webpack-dev-server 5.2.6

References

https://github.com/webpack/webpack-dev-server/security/ad...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pig-Tail
bjohansebas
UlisesGascon
.