@moneko/core (>=3.9.17-beta.25, <=3.11.1-beta.2), @proteinjs/server (>=1.0.1, <=2.1.10) +2 more potentially affected by CVE-2024-29180 via webpack-dev-middleware (7.0.0)

webpack-dev-middleware NPM version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on webpack-dev-middleware and may be impacted: - @moneko/core =3.9.17-beta.25, =1.0.1, =1.1.0, =0.0.101, =0.0.113 Source cves: CVE-2024-29180 Source advisory:...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +33265 more potentially affected by CVE-2024-29180 via webpack-dev-middleware (>=0.6.2, <=5.3.3)

webpack-dev-middleware NPM version =0.6.2, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...

CVE-2024-29180

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...

webpack-dev-middleware security vulnerabilities

webpack-dev-middleware is an express style development middleware for webpack open source . Used for webpack bundles and allows to provide files emitted from webpack. A security vulnerability exists in webpack-dev-middleware versions prior to 7.1.0, 6.1.2, and 5.3.4, which stems from a path...

CVE-2024-29180: Improper Limitation of a Pathname to a Restricted Directory

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...

PT-2026-80854

Name of the Vulnerable Software and Affected Versions webpack-dev-middleware versions 5.3.4 through 5.x webpack-dev-middleware versions 6.1.2 through 6.x webpack-dev-middleware versions 7.1.0 through 7.x Description The software fails to sufficiently validate URL addresses before returning local...

Denial Of Service (DoS)

webpack-dev-middleware is vulnerable to denial of service. A memory leak occurs when the function writeToDisk is used, causing the compile-time to keep increasing as the duplicates write to disk keep increasing, eventually leading to a denial of service condition...