CVE-2025-55182-analysis

1. 취약점 개요 최근 React의 역직렬화 RCE 취약점이 이슈가 되고 있습니다. 공식 CVSS는 10.0점으로, 당시 Log4j와 동일한 수준입니다. 한때 많은 소문이 현대 프론트엔드의 Log4j라고 불리며 많은 회사 개발자들의 공포를 불러일으켰고, 모두가 일어나자마자 다양한 문헌을 찾아보고 패치를 적용하기 시작했습니다... 동시에 온라인에서는 많은 의문이 제기되었으며, 일부 테스트 결과 이 취약점이 알려진 것만큼 심각하지 않고 오히려 특정 조건이 필요하다는 것이 밝혀졌습니다. 그래서 저는 시간을 내어 이 취약점을 깊이...

CLSA-2026-1790004677 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2...

webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...

CLSA-2026-1789721764 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.11.0-tuxcare.1...

Astra Linux – Vulnerability in node-loader-utils

A prototype pollution vulnerability exists in the parseQuery function in parseQuery.js, within the webpack-loader-utils module. This issue affects all versions prior to 1.4.1 and 2.0.3...

ROOT-APP-NPM-CVE-2024-29180 CVE-2024-29180 in webpack-dev-middleware - Patched by Root

Root has patched CVE-2024-29180 in the webpack-dev-middleware package for Root:npm. Multiple fixed versions available...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-44432 DESCRIPTION: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the...

ROOT-APP-NPM-CVE-2023-28154 CVE-2023-28154 in webpack - Patched by Root

Root has patched CVE-2023-28154 in the webpack package for Root:npm. Multiple fixed versions available...

CLSA-2026-1787931162 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 5.2.2-tuxcare.1...

SUSE CVE-2024-29180

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...

SUSE CVE-2026-76844

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

CLSA-2026-1787837620 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.2-tuxcare.3...

CLSA-2026-1787837465 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4...

CVE-2026-76844

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...

CLSA-2026-1787828309 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.7.3-tuxcare.6...

CLSA-2026-1787823957 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.1-tuxcare.3...

CLSA-2026-1787821986 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4...

Linux Distros Unpatched Vulnerability : CVE-2026-76844

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at...