Skip to content
OpenAdvisories

Vendor

webpack-dev-server

6 known vulnerabilities.

Products

webpack-dev-server 6
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.7
    CVE-2026-14620 Public exploit

    webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

    webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated fro…

    webpack-dev-server webpack-dev-server webpack-dev-server npm