npm/storybook CVE-2026-27148: critical 9.6, EPSS 0.63%
Storybook Dev Server is Vulnerable to WebSocket Hijacking
Action: Upgrade storybook to 8.6.17 or later.
npm i storybook@8.6.17npm i storybook@9.1.19npm i storybook@10.2.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.1.0 | 8.6.17 | - |
| 8.7.0-alpha.0 | 9.1.19 | - |
| 10.0.0-beta.0 | 10.2.10 | - |
Fixed versions
| 8.6.17 | 9.1.19 | 10.2.10 |
Sources
- osv: GHSA-mjf5-7g4m-gx5w
- nvd: CVE-2026-27148
- https://github.com/storybookjs/storybook/security/advisories/GHSA-mjf5-7g4m-gx5w
- https://github.com/storybookjs/storybook/commit/0affdf928bd6fafbadfb1dfe22ce6104805e10e8
- https://github.com/storybookjs/storybook/commit/54689a8add18ea75d628c540f4bc677592a1e685
- https://github.com/storybookjs/storybook/commit/b8cfa77c73940c140acdcd8a06ab1ea913c44761
- https://github.com/storybookjs/storybook/commit/d34085f39c647f5c23c3a3b2d197c18602fcf876
- https://github.com/storybookjs/storybook
- https://github.com/storybookjs/storybook/releases/tag/v10.2.10
- https://github.com/storybookjs/storybook/releases/tag/v7.6.23
- https://github.com/storybookjs/storybook/releases/tag/v8.6.17
- https://github.com/storybookjs/storybook/releases/tag/v9.1.19
CVE-2026-27148 · published · modified · JSON