CVE-2026-76844
Received
Received - Intake
Path Traversal in webpack-dev-middleware
Vulnerability report for CVE-2026-76844, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-24
Last updated on: 2026-08-24
Assigner: VulnCheck
Description
Description
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webpack | webpack-dev-middleware | From 5.3.4 (inc) |
| webpack | webpack-dev-middleware | From 6.1.2 (inc) |
| webpack | webpack-dev-middleware | From 7.1.0 (inc) |
| webpack | webpack-dev-middleware | to 5.3.3 (inc) |
| webpack | webpack-dev-middleware | 5.3.4 |
| webpack | webpack-dev-middleware | to 6.1.1 (inc) |
| webpack | webpack-dev-middleware | 6.1.2 |
| webpack | webpack-dev-middleware | to 7.0.9 (inc) |
| webpack | webpack-dev-middleware | 7.1.0 |
| webpack | webpack-dev-middleware | to 8.1.1 (exc) |
| webpack | webpack-dev-middleware | 8.1.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
