Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references. Original Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname again...

CVE-2026-76844

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write fails, gzwrite returns without resetting strm.nextin, leaving it pointed at the caller's buffer. A later gz write call then derives a position from the stale pointer and writes past a heap allocation; any write...

CVE-2026-76844

webpack-dev-middleware suffers from a path traversal vulnerability in its getFilenameFromUrl function, an incomplete fix for CVE-2024-29180 . When publicPath is configured without a trailing slash, a crafted request (e.g., GET /assets../.env against publicPath /assets) bypasses the UP_PATH_REGEXP...

PT-2026-80854

Name of the Vulnerable Software and Affected Versions webpack-dev-middleware versions 5.3.4 through 5.x webpack-dev-middleware versions 6.1.2 through 6.x webpack-dev-middleware versions 7.1.0 through 7.x Description The software fails to sufficiently validate URL addresses before returning local...

Denial Of Service (DoS)

webpack-dev-middleware is vulnerable to denial of service. A memory leak occurs when the function writeToDisk is used, causing the compile-time to keep increasing as the duplicates write to disk keep increasing, eventually leading to a denial of service condition...