EUVD-2026-65456

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

CVE-2026-79658: Uncontrolled Resource Consumption

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...

PT-2026-81284

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

CLSA-2026-1787602147 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.5-tuxcare.1...

@angular-architects/native-federation (>=20.3.1, <=21.2.6), @angular-architects/native-federation-v4 (>=20.3.0, <=21.2.16) +111 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.5)

webpack-dev-middleware NPM version =7.0.0, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =1.0.0, =6.0.0, =21.2.2-depup.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =6.0.0-edsv2-beta-3 and more Source cves: CVE-2026-76844 Source advisory:...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as...

@angular-devkit/build-angular (>=22.0.0-next.4, <=22.2.0-next.6), @depup/angular-devkit__build-angular (>=22.0.7-depup.0, <=22.0.7-depup.2) +5 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.2, <=8.1.1)

webpack-dev-middleware NPM version =8.0.2, =22.0.0-next.4, =22.0.7-depup.0, =23.0.0-alpha.2, =23.0.0-alpha.2, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: SNYK:JS-WEBPACKDEVMIDDLEWARE-19643962...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as...

Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references. Original Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname again...

GHSA-P3F5-W63M-MXPH Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references. Original Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname again...

CVE-2026-76844

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-76844

webpack-dev-middleware suffers from a path traversal vulnerability in its getFilenameFromUrl function, an incomplete fix for CVE-2024-29180 . When publicPath is configured without a trailing slash, a crafted request (e.g., GET /assets../.env against publicPath /assets) bypasses the UP_PATH_REGEXP...

@angular-devkit/build-angular (>=22.0.0-next.4, <=22.2.0-next.6), @depup/angular-devkit__build-angular (>=22.0.7-depup.0, <=22.0.7-depup.2) +5 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.2, <=8.1.1)

webpack-dev-middleware NPM version =8.0.2, =22.0.0-next.4, =22.0.7-depup.0, =23.0.0-alpha.2, =23.0.0-alpha.2, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: MEND:CVE-2026-76844...

CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +55735 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=0.6.2, <=7.4.5)

webpack-dev-middleware NPM version =0.6.2, =1.0.1, =0.1.0, =1.0.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 and more Source cves: CVE-2026-76844...

CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-53624

A flaw was found in the Fiber web framework's helmet middleware. This vulnerability occurs because the middleware incorrectly checks for the HTTPS protocol, preventing the Strict-Transport-Security HSTS response header from being set. This can allow an attacker to bypass security mechanisms,...

PT-2026-85329

TuxCare rebuilt webpack-dev-middleware to address 4 CVEs. Fixed in 7.4.5-tuxcare.1...

CVE-2026-76844: Out-of-bounds Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...