CVE-2026-27148

npm/storybook CVE-2026-27148: high

Storybook Dev Server is Vulnerable to WebSocket Hijacking

Action: Upgrade storybook to 8.6.17 or later.

npm i storybook@8.6.17

npm i storybook@9.1.19

npm i storybook@10.2.10

Affected

Fixed versions

Sources

• osv: GHSA-mjf5-7g4m-gx5w
• https://github.com/storybookjs/storybook/security/advisories/GHSA-mjf5-7g4m-gx5w
• https://nvd.nist.gov/vuln/detail/CVE-2026-27148
• https://github.com/storybookjs/storybook/commit/0affdf928bd6fafbadfb1dfe22ce6104805e10e8
• https://github.com/storybookjs/storybook/commit/54689a8add18ea75d628c540f4bc677592a1e685
• https://github.com/storybookjs/storybook/commit/b8cfa77c73940c140acdcd8a06ab1ea913c44761
• https://github.com/storybookjs/storybook/commit/d34085f39c647f5c23c3a3b2d197c18602fcf876
• https://github.com/storybookjs/storybook
• https://github.com/storybookjs/storybook/releases/tag/v10.2.10
• https://github.com/storybookjs/storybook/releases/tag/v7.6.23
• https://github.com/storybookjs/storybook/releases/tag/v8.6.17
• https://github.com/storybookjs/storybook/releases/tag/v9.1.19

CVE-2026-27148 · published 2026-02-26T15:16:10Z · modified 2026-02-26T15:32:56.650508Z · JSON