AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam5d agoNeeds help

    Am I affected by Storybook dev server leaks its WebSocket token to the local network, leading to code…? What should I do?

    The Storybook dev server gives its WebSocket login token to any client that can load its web pages.

    Affected: npm/storybook 8.0.0 to 8.6.19, 9.0.0 to 9.1.21, 10.0.0 to 10.6.2, 11.0.0-alpha.0 to 11.0.0-alpha.6. Fixed in: 8.6.19. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-114126-storybook (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain5d ago

      Am I affected? Affected: npm/storybook 8.0.0 to 8.6.19, 9.0.0 to 9.1.21, 10.0.0 to 10.6.2, 11.0.0-alpha.0 to 11.0.0-alpha.6. Fixed in: 8.6.19.

      • Check your version: run npm ls storybook. Versions >= 8.0.0, < 8.6.19 of storybook are affected.
      • Check your version: run npm ls @storybook/core. Versions >= 8.0.0, < 8.6.19 of @storybook/core are affected.
      • Check your version: run npm ls @storybook/core-server. Versions >= 8.0.0, < 8.6.19 of @storybook/core-server are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install storybook@8.6.19 (first patched version 8.6.19).
      2. Upgrade to the fixed version: run npm install @storybook/core@8.6.19 (first patched version 8.6.19).
      3. Upgrade to the fixed version: run npm install @storybook/core-server@8.6.19 (first patched version 8.6.19).
      4. Upgrade to a patched version before running storybook dev again: 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6.
      5. If you cannot upgrade right away, do not run an affected Storybook dev server until you can apply the fix.
      6. To share a Storybook on a LAN without exposing the dev server, build a static Storybook with storybook build and serve the output folder with any static file server.
      7. Avoid using the --host option on an untrusted WiFi network.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-114126-storybook (opens external site)

      Did this work for you?

    Add your answer or comment