PT-2026-96865

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4...

PT-2026-86552

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4...

Linux Distros Unpatched Vulnerability : CVE-2026-76844

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at...

PT-2026-86547

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.1-tuxcare.3...

PT-2026-86548

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.7.3-tuxcare.6...

CLSA-2026-1787602147 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.5-tuxcare.1...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as...

@angular-architects/native-federation (>=20.3.1, <=21.2.6), @angular-architects/native-federation-v4 (>=20.3.0, <=21.2.15) +112 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.5)

webpack-dev-middleware NPM version =7.0.0, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =1.0.0, =6.0.0, =21.2.2-depup.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =6.0.0-edsv2-beta-3 and more Source cves: CVE-2026-76844 Source advisory:...

@angular-devkit/build-angular (>=22.0.0-next.4, <=22.2.0-next.6), @depup/angular-devkit__build-angular (>=22.0.7-depup.0, <=22.0.7-depup.2) +5 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.2, <=8.1.1)

webpack-dev-middleware NPM version =8.0.2, =22.0.0-next.4, =22.0.7-depup.0, =23.0.0-alpha.2, =23.0.0-alpha.2, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: SNYK:JS-WEBPACKDEVMIDDLEWARE-19643962...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as...

GHSA-P3F5-W63M-MXPH Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references. Original Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname again...

Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references. Original Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname again...

Malicious Package

Overview specials-obid-webpack is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-76844

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-76844

webpack-dev-middleware suffers from a path traversal vulnerability in its getFilenameFromUrl function, an incomplete fix for CVE-2024-29180 . When publicPath is configured without a trailing slash, a crafted request (e.g., GET /assets../.env against publicPath /assets) bypasses the UP_PATH_REGEXP...

CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

Malicious Package

Overview sme-scripts-shared-library-webpack-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

CVE-2026-76844: Improper Limitation of a Pathname to a Restricted Directory

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...