Skip to content
Fencer Vulns
medium 4.7

CVE-2026-14620 json

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

published 2026-07-03 4 mo ago modified 2026-09-10 1 mo ago also GHSA-f5vj-f2hx-8m93 , EUVD-2026-41558

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
1
Exploit-DB

Summary

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.

Patch / fix

  • npm webpack-dev-server 5.2.6
  • webpack-dev-server webpack-dev-server 5.2.6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-14620 updated cvss 4.7

webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints

  • Red Hat Cryostat 4 webpack-dev-server 5.2.4, cryostat-openshift-console-plugin-npm Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    +20 more products
    Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat AMQ Broker 7 webpack-dev-server 5.2.4 Red Hat Ansible Automation Platform 2 automation-eda-controller 1.0.11-1.el9ap, ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-27/gateway-rhel9, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9, +1 more Red Hat build of Apache Camel - HawtIO 4 webpack-dev-server 5.2.4 Red Hat build of Apache Camel for Spring Boot 4 webpack-dev-server 5.2.4 Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 webpack-dev-server 5.2.4 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-loki, grafana-mssql, grafana-mysql, +13 more Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, grafana-selinux, pcs 0.12.0-3.el10_0.5, grafana 10.2.6-24.el10_0, +1 more Red Hat Enterprise Linux 10 pcs 0.12.0-3.el10_0.5, grafana 10.2.6-24.el10_0, js-d3-flame-graph 4.0.7-10.el10 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-agent-installer-ui-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 quay/quay-rhel8 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-52649)

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52649 webpack_devserver 5.2.5 - CSRF webapps, 2026-08-17

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L
NVD 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L
GitHub 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
npm webpack-dev-server
<5.2.6
5.2.6

Affected products

  • webpack-dev-server webpack-dev-server

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery
  • CWE-749 Exposed Dangerous Method or Function

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.