PT-2026-110380

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.0-tuxcare.4...

PT-2026-110368

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 8.1.1-tuxcare.1...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-102930 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-102938 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

Security Bulletin: Vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer. Vulnerabilities include a crafted Host header that is only a superstring match for a configured host+path key can still route a...

Interpretation Conflict

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Interpretation Conflict via absolute-form request targets in the Fastify adapter's middleware registration. When a request is made using...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

GHSA-9C5C-9QCX-Q35Q @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

CLSA-2026-1790756051 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.2-tuxcare.1...

CLSA-2026-1790755864 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.3-tuxcare.2...

PT-2026-109629

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.3-tuxcare.2...

PT-2026-109632

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.2-tuxcare.1...

EUVD-2026-64850

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...

GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

@angular-devkit/build-angular (>=22.0.0-next.4, <=22.2.0-next.6), @depup/angular-devkit__build-angular (>=22.0.7-depup.0, <=22.0.7-depup.2) +5 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.2, <=8.1.1)

webpack-dev-middleware NPM version =8.0.2, =22.0.0-next.4, =22.0.7-depup.0, =23.0.0-alpha.2, =23.0.0-alpha.2, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: GHSA-G84C-RXFJ-3J2C...

@angular-devkit/build-angular (>=22.0.0-next.4, <=22.2.0-next.6), @depup/angular-devkit__build-angular (>=22.0.7-depup.0, <=22.0.7-depup.2) +5 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.2, <=8.1.1)

webpack-dev-middleware NPM version =8.0.2, =22.0.0-next.4, =22.0.7-depup.0, =23.0.0-alpha.2, =23.0.0-alpha.2, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: OSV:GHSA-G84C-RXFJ-3J2C...

@angular-architects/native-federation (20.3.1), @angular-architects/native-federation-v4 (>=20.3.1, <=20.4.3) +104 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.3)

webpack-dev-middleware NPM version =7.0.0, =20.3.1, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =6.0.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =18.0.0-next.1, =18.0.0-next.1, =21.0.0-alpha.32 and more Source cves: CVE-2026-76844 Source advisory: GHSA-G84C-RXFJ-3J2C...

NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath vulnerability discovered by ? in WordPress Npm webpack-dev-middleware versions 7.4.5...