{"resultsPerPage":6,"startIndex":0,"totalResults":6,"format":"NVD_CVEHistory","version":"2.0","timestamp":"2026-11-11T01:49:13.467","cveChanges":[{"change":{"cveId":"CVE-2026-76844","eventName":"New CVE Received","cveChangeId":"D5BDA399-8A4E-490C-B8C9-35E4048A5660","sourceIdentifier":"disclosure@vulncheck.com","created":"2026-08-24T14:17:02.250","details":[{"action":"Added","type":"Description","newValue":"webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`.\/${pathname}`), only matches \"..\" that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET \/assets..\/.env against publicPath \/assets yields the pathname \/assets..\/.env, whose only dot-dot sits inside the segment \"assets..\" and so passes the guard, but the offset slice cuts within that segment and hands \"..\/.env\" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of \"auto\" resolves to \"\/\" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward."},{"action":"Added","type":"CVSS V4.0","newValue":"AV:N\/AC:L\/AT:N\/PR:N\/UI:P\/VC:H\/VI:N\/VA:N\/SC:H\/SI:N\/SA:N\/E:X\/CR:X\/IR:X\/AR:X\/MAV:X\/MAC:X\/MAT:X\/MPR:X\/MUI:X\/MVC:X\/MVI:X\/MVA:X\/MSC:X\/MSI:X\/MSA:X\/S:X\/AU:X\/R:X\/V:X\/RE:X\/U:X"},{"action":"Added","type":"CVSS V3.1","newValue":"AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:H\/I:N\/A:N"},{"action":"Added","type":"CWE","newValue":"CWE-22"},{"action":"Added","type":"Affected","newValue":"New affected value received.  <a href=\"https:\/\/github.com\/CVEProject\/cvelistV5\/blob\/main\/cves\/2026\/76xxx\/CVE-2026-76844.json\">CVE-2026-76844<\/a>"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/advisories\/GHSA-wr3j-pwj9-hqq6"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/blob\/v8.1.1\/src\/middleware.js"},{"action":"Added","type":"Reference","newValue":"https:\/\/www.vulncheck.com\/advisories\/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"}]}},{"change":{"cveId":"CVE-2026-76844","eventName":"CVE Modified","cveChangeId":"A1714F89-A5DC-43B5-BDC8-7E39DB76745F","sourceIdentifier":"disclosure@vulncheck.com","created":"2026-08-26T19:17:05.053","details":[{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/advisories\/GHSA-wr3j-pwj9-hqq6"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/blob\/v8.1.1\/src\/middleware.js"},{"action":"Added","type":"Reference","newValue":"https:\/\/www.vulncheck.com\/advisories\/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/advisories\/GHSA-wr3j-pwj9-hqq6"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/blob\/v8.1.1\/src\/middleware.js"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/www.vulncheck.com\/advisories\/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"}]}},{"change":{"cveId":"CVE-2026-76844","eventName":"CVE Modified","cveChangeId":"6369B8C4-9425-4CD4-B5F6-6C3B621DD7C9","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-08-26T19:17:05.053","details":[{"action":"Added","type":"SSVC","newValue":{"timestamp":"2026-08-26T18:22:33.313523Z","id":"CVE-2026-76844","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]}},{"change":{"cveId":"CVE-2026-76844","eventName":"CVE Modified","cveChangeId":"2FEAA68F-9C6E-43FF-9704-F5213789D83F","sourceIdentifier":"disclosure@vulncheck.com","created":"2026-10-01T11:17:27.070","details":[{"action":"Changed","type":"Description","oldValue":"webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`.\/${pathname}`), only matches \"..\" that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET \/assets..\/.env against publicPath \/assets yields the pathname \/assets..\/.env, whose only dot-dot sits inside the segment \"assets..\" and so passes the guard, but the offset slice cuts within that segment and hands \"..\/.env\" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of \"auto\" resolves to \"\/\" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.","newValue":"webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as \/assets..\/secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem."},{"action":"Added","type":"Affected","newValue":"Affected value modified.  <a href=\"https:\/\/github.com\/CVEProject\/cvelistV5\/blob\/main\/cves\/2026\/76xxx\/CVE-2026-76844.json\">CVE-2026-76844<\/a>"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/commit\/13344e78b26d88fe9b7c8381a3860e248a52359b"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/commit\/cefccbac330c29052fc6dffe85fd292ea2ac782b"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/releases\/tag\/v7.4.6"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/releases\/tag\/v8.3.0"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/security\/advisories\/GHSA-g84c-rxfj-3j2c"}]}},{"change":{"cveId":"CVE-2026-76844","eventName":"CVE Modified","cveChangeId":"CA667BA6-716D-4721-9C72-33185F5EDEBD","sourceIdentifier":"disclosure@vulncheck.com","created":"2026-10-01T12:17:16.387","details":[{"action":"Changed","type":"Description","oldValue":"webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as \/assets..\/secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem.","newValue":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."},{"action":"Added","type":"CVSS V4.0","newValue":"AV:N\/AC:H\/AT:N\/PR:N\/UI:N\/VC:N\/VI:H\/VA:H\/SC:N\/SI:N\/SA:N\/E:X\/CR:X\/IR:X\/AR:X\/MAV:X\/MAC:X\/MAT:X\/MPR:X\/MUI:X\/MVC:X\/MVI:X\/MVA:X\/MSC:X\/MSI:X\/MSA:X\/S:X\/AU:X\/R:X\/V:X\/RE:X\/U:X"},{"action":"Removed","type":"CVSS V4.0","oldValue":"AV:N\/AC:L\/AT:N\/PR:N\/UI:P\/VC:H\/VI:N\/VA:N\/SC:H\/SI:N\/SA:N\/E:X\/CR:X\/IR:X\/AR:X\/MAV:X\/MAC:X\/MAT:X\/MPR:X\/MUI:X\/MVC:X\/MVI:X\/MVA:X\/MSC:X\/MSI:X\/MSA:X\/S:X\/AU:X\/R:X\/V:X\/RE:X\/U:X"},{"action":"Added","type":"CVSS V3.1","newValue":"AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:H"},{"action":"Removed","type":"CVSS V3.1","oldValue":"AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:H\/I:N\/A:N"},{"action":"Added","type":"CWE","newValue":"CWE-787"},{"action":"Removed","type":"CWE","oldValue":"CWE-22"},{"action":"Added","type":"Affected","newValue":"Affected value modified.  <a href=\"https:\/\/github.com\/CVEProject\/cvelistV5\/blob\/main\/cves\/2026\/76xxx\/CVE-2026-76844.json\">CVE-2026-76844<\/a>"},{"action":"Added","type":"Reference","newValue":"https:\/\/gist.github.com\/thesmartshadow\/e0b9481792afb7c31e86fee1ff084490"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/madler\/zlib"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/madler\/zlib\/blob\/v1.3.2\/gzwrite.c#L393"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/madler\/zlib\/commit\/df84af25dc1942490e1d1c899a07619152a46148"},{"action":"Added","type":"Reference","newValue":"https:\/\/www.vulncheck.com\/advisories\/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/advisories\/GHSA-wr3j-pwj9-hqq6"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/blob\/v8.1.1\/src\/middleware.js"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/commit\/13344e78b26d88fe9b7c8381a3860e248a52359b"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/commit\/cefccbac330c29052fc6dffe85fd292ea2ac782b"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/releases\/tag\/v7.4.6"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/releases\/tag\/v8.3.0"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/webpack\/webpack-dev-middleware\/security\/advisories\/GHSA-g84c-rxfj-3j2c"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/www.vulncheck.com\/advisories\/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"}]}},{"change":{"cveId":"CVE-2026-76844","eventName":"CVE Translated","cveChangeId":"63C63B5D-61D6-405C-A2B4-379064280CFA","sourceIdentifier":"nvd@nist.gov","created":"2026-10-12T17:10:00.163","details":[{"action":"Added","type":"Translation","newValue":"Title: webpack-dev-middleware de webpack, Description: zlib 1.2.11 hasta 1.3.2 contiene un desbordamiento de búfer de montón: después de que falle una llamada subyacente a write(), gz_write() retorna sin restablecer strm.next_in, dejándolo apuntando al búfer del llamador. Una llamada posterior de escritura gz entonces deriva una posición a partir del puntero obsoleto y escribe más allá de una asignación de montón; cualquier fallo de write() lo alcanza, incluyendo EPIPE en un descriptor de bloqueo, y en versiones anteriores a la 1.3.1.2 la escritura fallida debe ir seguida de una llamada a gzclearerr()."}]}}]}