webpack-dev-server CVE-2026-14620

Upgrade to webpack-dev-server 5.2.6, which is the vendor-released patch confirmed by the OpenJS Foundation CNA and the GitHub Security Advisory GHSA-f5vj-f2hx-8m93. No workarounds are identified - the advisory explicitly states none exist, so the upgrade is the only supported remediation path. Teams should update their package.json devDependencies or lockfiles accordingly and re-run dependency installation. As a defense-in-depth measure independent of patching, webpack-dev-server should never be bound to a non-loopback interface during development; if firewall or network policy enforcement prevents localhost-only binding, blocking inbound connections to the dev server port at the host firewall will prevent cross-origin browser requests from reaching the endpoints. Note that this network-level control does not mitigate the attack if the malicious page is loaded on the same machine as the dev server.