CVE-2026-76844: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
[!IMPORTANT] CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were notified before publication, and no fix was available at that time. This advisory is the coordinated record produced by the webpack maintainers and the OpenJS Foundation CNA.
References
- github.com/advisories/GHSA-g84c-rxfj-3j2c
- github.com/advisories/GHSA-wr3j-pwj9-hqq6
- github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js
- github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b
- github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b
- github.com/webpack/webpack-dev-middleware/pull/2404
- github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6
- github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0
- github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c
- nvd.nist.gov/vuln/detail/CVE-2026-76844
- www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath
Code Behaviors & Features
Detect and mitigate CVE-2026-76844 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →