Path Traversal in webpack-dev-middleware (CVE-2026-76844)

CVE-2026-76844 is a path traversal vulnerability in the webpack-dev-middleware package, impacting versions 5.3.4, 6.1.2, and 7.1.0 and later. The vulnerability stems from an incomplete remediation of CVE-2024-29180. The function getFilenameFromUrl improperly validates request pathnames when the configured publicPath lacks a trailing slash. By crafting a request such as /assets../.env against a publicPath of /assets, the internal traversal guard is bypassed because the dot-dot sequence is embedded within a path segment rather than standing alone.

This flaw allows the middleware to resolve paths outside the intended output directory, effectively handing a path like ../.env to the underlying filesystem resolution logic. The impact is restricted to environments where the middleware is configured with writeToDisk set to true or utilizes a custom outputFileSystem that interacts with the host's physical disk, as the default memory-based filesystem is not vulnerable. The traversal depth is limited to one directory level.

Impact

Successful exploitation allows an unauthorized remote attacker to read sensitive files located one directory above the configured webpack output directory. This could result in the exposure of environment variables, configuration files, or other sensitive data accessible to the user account running the Node.js process. The vulnerability is present in widely used build middleware, potentially impacting any web application or build pipeline utilizing these affected versions in a development or production environment with physical disk access enabled.

Recommendation

• Update webpack-dev-middleware to a patched version once released by the maintainers.
• Audit application configurations to ensure publicPath is consistently defined with a trailing slash where possible.
• Disable writeToDisk in development middleware configurations if physical filesystem access is not strictly required for the build pipeline.
• Deploy web server or WAF rules to block requests containing sequences that attempt to merge directory segments and dots, specifically patterns where a segment name is followed by '..' without a trailing slash.