CVE-2026-76844

Name of the Vulnerable Software and Affected Versions webpack-dev-middleware versions 5.3.4 through 5.x webpack-dev-middleware versions 6.1.2 through 6.x webpack-dev-middleware versions 7.1.0 through 7.x

Description The software fails to sufficiently validate URL addresses before returning local files, allowing potential access to files on the developer's machine. This occurs in the getFilenameFromUrl() function when the publicPath is configured without a trailing slash. An attacker can craft a request where a dot-dot sequence is embedded within a path segment (e.g., /assets../.env), bypassing the traversal guard. The system then slices the path at a fixed offset, resulting in a path traversal that resolves one directory above the output path. This issue specifically affects environments where the middleware is backed by the physical filesystem, such as when the writeToDisk variable is set to true or a custom outputFileSystem is provided. If the development server is exposed to a network or allows cross-origin requests, an attacker could exfiltrate sensitive files like passwords or source code.

Recommendations For webpack-dev-middleware versions 5.3.4 through 5.x, 6.1.2 through 6.x, and 7.1.0 through 7.x, set the writeToDisk variable to false or avoid using a custom outputFileSystem to prevent physical filesystem access. As a temporary mitigation, ensure the publicPath configuration ends with a trailing slash to prevent the offset slicing bypass.