CVE-2026-14620

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.6

Description Internal developer endpoints '/webpack-dev-server/open-editor' and '/webpack-dev-server/invalidate' perform state-changing actions on GET requests without verifying the request origin. This allows any website visited by a developer to trigger these endpoints cross-origin. An attacker can open arbitrary local files in the developer's editor, including those outside the project root. Additionally, repeated requests can spawn multiple editor processes and force recompilations, leading to system performance degradation.

Recommendations Upgrade to webpack-dev-server 5.2.6.