Listen to this Post
CVE-2026-76844 affects webpack-dev-middleware.
It is a path traversal issue.
It occurs in getFilenameFromUrl.
The function resolves requests to local files.
The configured publicPath is used.
If publicPath lacks trailing slash, risk rises.
Example publicPath is /assets.
A request like /assets../secret shares prefix.
It is not actually under /assets.
The containment check still passes.
The .. guard runs before publicPath strip.
So it does not catch traversal.
The publicPath prefix is stripped later.
The remainder contains ../.
That remainder is joined to output directory.
The joined path escapes output root.
An unauthenticated request can read files.
Files outside output root may leak.
Affected apps use webpack-dev-middleware.
They may use webpack-dev-server.
publicPath must not end in slash.
A network-reachable dev server is vulnerable.
One request can trigger it.
No victim interaction is needed.
VulnCheck assigned CVE-2026-76844.
Published 2026-08-24.
No prior coordination occurred.
Patched in webpack-dev-middleware 8.3.0.
No backport to 5.x, 6.x, 7.x.
Upgrade to 8.3.0 or later.
Workaround uses trailing slash.
Example /assets/ instead of /assets.
This is coordinated advisory record.
DailyCVE Form:
Platform: webpack-dev-middleware
Version: <8.3.0
Vulnerability : Path traversal
Severity: Not stated
date: 2026-08-24
Prediction: Expected date unknown
(end of form)
What Undercode Say:
curl --path-as-is 'http://127.0.0.1:8080/assets../secret' curl --path-as-is 'http://127.0.0.1:8080/assets../package.json'
const webpack = require('webpack');
const webpackDevMiddleware = require('webpack-dev-middleware');
const compiler = webpack({});
app.use(webpackDevMiddleware(compiler, { publicPath: '/assets' }));
app.use(webpackDevMiddleware(compiler, { publicPath: '/assets/' }));
Exploit: (Educational Purposes!)
curl --path-as-is 'http://target/assets../secret' curl --path-as-is 'http://target/assets../etc/passwd'
Protection: from this CVE
npm install [email protected]
app.use(webpackDevMiddleware(compiler, { publicPath: '/assets/' }));
Impact:
Unauthenticated file read.
Outside output root.
Single request.
No victim interaction.
Network-reachable dev servers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
