CVE-2026-76844

CVSS 8.3 (high) · published 2026-08-24

webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem.

Weakness: CWE-22

Source: NVD CVE-2026-76844

References

• https://github.com/advisories/GHSA-wr3j-pwj9-hqq6
• https://github.com/webpack/webpack-dev-middleware
• https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js
• https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b
• https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b
• https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6
• https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0
• https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c
• https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.