{"action":"Upgrade webpack-dev-server to 5.2.6 or later.","affected":[{"fixed":"5.2.6","introduced":"0"}],"component":"webpack-dev-server","cve_ids":["CVE-2026-14620"],"ecosystem":"npm","epss":0.00521,"exploited":false,"fixed_versions":["5.2.6"],"ghsa_id":"GHSA-f5vj-f2hx-8m93","id":"tcs_01M5KFMJ8QPMQNDEBPYPMSN0T4","modified_at":"2026-09-10T03:50:51.837057467Z","published_at":"2026-07-20T22:01:56Z","references":["https://osv.dev/vulnerability/GHSA-f5vj-f2hx-8m93","https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93","https://nvd.nist.gov/vuln/detail/CVE-2026-14620","https://github.com/webpack/webpack-dev-server/pull/5698","https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c","https://cna.openjsf.org/security-advisories.html","https://github.com/webpack/webpack-dev-server","https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-f5vj-f2hx-8m93","url":"https://osv.dev/vulnerability/GHSA-f5vj-f2hx-8m93"}],"summary":"webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints"}