# storybook (npm) vulnerabilities 4 known vulnerabilities (4 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.6.6 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 10.6.6 (Nov 5, 2026), the latest release - Weekly downloads: 34.9M - Dependents: 177 - Releases: 500+ since 7.6.23 (Feb 18, 2026) - Registry: https://www.npmjs.com/package/storybook - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114126: 8.6.17 to 8.6.18 (8.6.19 is outside it); 9.1.19 to 9.1.20 (9.1.21 is outside it); 10.2.10 to 10.6.1 (10.6.2 is outside it); 11.0.0-alpha.0 to 11.0.0-alpha.5 (11.0.0-alpha.6 is outside it) - CVE-2026-114125: 8.6.17 to 8.6.18 (8.6.19 is outside it); 9.1.19 to 9.1.20 (9.1.21 is outside it); 10.2.10 to 10.6.1 (10.6.2 is outside it); 11.0.0-alpha.0 to 11.0.0-alpha.5 (11.0.0-alpha.6 is outside it) - CVE-2026-27148: no published release is affected - CVE-2025-68429: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (4) ### [CVE-2026-114126](https://cve.now/CVE-2026-114126): Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files - Severity: High 8.7 - Published: Oct 21, 2026 - Affected: from 8.0.0, fixed in 8.6.19; from 9.0.0, fixed in 9.1.21; from 10.0.0, fixed in 10.6.2; from 11.0.0-alpha.0, fixed in 11.0.0-alpha.6. - Fixed in 8.6.19 (released Oct 12, 2026, 9 days before disclosure), 9.1.21 (released Oct 12, 2026, 9 days before disclosure), 10.6.2 (released Oct 12, 2026, 9 days before disclosure) and 1 other version. - The latest release, 10.6.6, is not affected. - 51% of storybook downloads last week were affected versions (19.3M). ### [CVE-2026-114125](https://cve.now/CVE-2026-114125): Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites - Severity: High 8.6 - Published: Oct 21, 2026 - Affected: from 8.0.0, fixed in 8.6.19; from 9.0.0, fixed in 9.1.21; from 10.0.0, fixed in 10.6.2; from 11.0.0-alpha.0, fixed in 11.0.0-alpha.6. - Fixed in 8.6.19 (released Oct 12, 2026, 9 days before disclosure), 9.1.21 (released Oct 12, 2026, 9 days before disclosure), 10.6.2 (released Oct 12, 2026, 9 days before disclosure) and 1 other version. - The latest release, 10.6.6, is not affected. - 51% of storybook downloads last week were affected versions (19.3M). ### [CVE-2026-27148](https://cve.now/CVE-2026-27148): Storybook Dev Server Vulnerable to WebSocket Hijacking - Severity: High 8.9 - Published: Feb 25, 2026 - Affected: from 8.1.0, fixed in 8.6.17; from 8.7.0-alpha.0, fixed in 9.1.19; from 10.0.0-beta.0, fixed in 10.2.10. - Fixed in 8.6.17 (released Feb 18, 2026, 7 days before disclosure), 9.1.19 (released Feb 18, 2026, 7 days before disclosure) and 10.2.10 (released Feb 18, 2026, 7 days before disclosure). - The latest release, 10.6.6, is not affected. - 15% of storybook downloads last week were affected versions (5.5M). ### [CVE-2025-68429](https://cve.now/CVE-2025-68429): Storybook manager bundle may expose environment variables during build - Severity: High 7.3 - Published: Dec 17, 2025 - Affected: from 7.0.0, fixed in 7.6.21; from 8.0.0, fixed in 8.6.15; from 9.0.0, fixed in 9.1.17; from 10.0.0, fixed in 10.1.10. - Fixed in 7.6.23 (released Feb 18, 2026, 63 days after disclosure, the advisory names 7.6.21, which was never published), 8.6.17 (released Feb 18, 2026, 63 days after disclosure, the advisory names 8.6.15, which was never published), 9.1.19 (released Feb 18, 2026, 63 days after disclosure, the advisory names 9.1.17, which was never published) and 1 other version. - The latest release, 10.6.6, is not affected. - 14% of storybook downloads last week were affected versions (5.5M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/storybook Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.