55 matches found
webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal
A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...
CLSA-2026-1789721764 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.11.0-tuxcare.1...
ROOT-APP-NPM-CVE-2024-29180 CVE-2024-29180 in webpack-dev-middleware - Patched by Root
Root has patched CVE-2024-29180 in the webpack-dev-middleware package for Root:npm. Multiple fixed versions available...
SUSE CVE-2024-29180
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...
SUSE CVE-2026-76844
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...
CVE-2026-76844
A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...
Linux Distros Unpatched Vulnerability : CVE-2026-76844
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at...
CLSA-2026-1787602147 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.5-tuxcare.1...
@angular-builders/custom-webpack (>=22.0.0-beta.0, <=22.0.2-beta.1), @angular-devkit/build-angular (>=22.0.0-next.4, <=22.2.0-next.6) +18 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.2, <=8.1.1)
webpack-dev-middleware NPM version =8.0.2, =22.0.0-beta.0, =22.0.0-next.4, =5.0.0, =22.0.7-depup.0, =15.0.0-next.2, =21.0.0-alpha.1, =8.17.0-nightly.20260605232913, =16.10.0, =11.0.8, =1.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-76844 Source advisory: SNYK:JS-WEBPACKDEVMIDDLEWARE-1964396...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as...
@angular-architects/native-federation (>=20.3.1, <=21.2.5), @angular-architects/native-federation-v4 (>=20.3.0, <=21.2.11) +111 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.5)
webpack-dev-middleware NPM version =7.0.0, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =1.0.0, =6.0.0, =21.2.2-depup.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =6.0.0-edsv2-beta-3 and more Source cves: CVE-2026-76844 Source advisory:...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as...
CVE-2026-76844
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...
CVE-2026-76844
webpack-dev-middleware suffers from a path traversal vulnerability in its getFilenameFromUrl function, an incomplete fix for CVE-2024-29180 . When publicPath is configured without a trailing slash, a crafted request (e.g., GET /assets../.env against publicPath /assets) bypasses the UP_PATH_REGEXP...
CVE-2026-76844 webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...
EUVD-2026-64850
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...
CVE-2026-76844 webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...
CVE-2026-76844 webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...
CVE-2026-76844: Improper Limitation of a Pathname to a Restricted Directory
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...