CVE-2026-76844

Deferred Deferred - Pending Action

Path Traversal in webpack-dev-middleware

Publication date: 2026-08-24

Last updated on: 2026-10-01

Assigner: VulnCheck

Description

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-10-01

Generated

2026-10-04

AI Q&A

2026-08-24

EPSS Evaluated

2026-10-02

NVD

CVE-2026-76844

EUVD

EUVD-2026-64850

Affected Vendors & Products

Vendor	Product	Version / Range
webpack	webpack-dev-middleware	From 5.3.4 (inc)
webpack	webpack-dev-middleware	From 6.1.2 (inc)
webpack	webpack-dev-middleware	From 7.1.0 (inc)
webpack	webpack-dev-middleware	to 5.3.3 (inc)
webpack	webpack-dev-middleware	5.3.4
webpack	webpack-dev-middleware	to 6.1.1 (inc)
webpack	webpack-dev-middleware	6.1.2
webpack	webpack-dev-middleware	to 7.0.9 (inc)
webpack	webpack-dev-middleware	7.1.0
webpack	webpack-dev-middleware	to 8.1.1 (exc)
webpack	webpack-dev-middleware	8.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-76844 is a path traversal vulnerability in webpack-dev-middleware. It occurs when the publicPath configuration lacks a trailing slash, allowing malicious requests like /assets../.env to bypass protections. The middleware incorrectly processes such paths, extracting segments like ../.env that resolve to parent directories. Exploitation requires the middleware to use the physical filesystem (e.g., writeToDisk enabled). The default publicPath 'auto' is unaffected.

Detection Guidance

To detect this vulnerability, check if your webpack-dev-middleware version is affected (5.3.4 and below, 6.1.3 and below, 7.4.5 and below, or 8.1.1 and below). Inspect server logs for requests containing path traversal patterns like /assets../ or similar sequences. Use tools like curl to test if the server responds to crafted URLs such as GET /assets../.env when publicPath lacks a trailing slash.

Impact Analysis

This vulnerability allows attackers to read arbitrary files on the server's filesystem if the middleware uses the physical filesystem. Sensitive files like .env, configuration files, or source code could be exposed. Attackers need to craft specific URLs targeting the vulnerable publicPath setup. The impact is limited to one directory level due to URL parsing collapsing additional traversal attempts.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of configuration files, credentials, or personal data may result in non-compliance, legal penalties, or data breach notifications. Organizations must patch affected versions to maintain compliance.

Mitigation Strategies

Upgrade webpack-dev-middleware to the latest patched version (above 5.3.4, 6.1.3, 7.4.5, or 8.1.1). Ensure publicPath always ends with a trailing slash. Disable writeToDisk or custom outputFileSystem if not required. Review server configurations to restrict access to sensitive directories.

Hi! I’m here to help you understand CVE-2026-76844. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70