Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-76844— webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath

Quick assessment

Affected
webpack webpack-dev-middleware
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

webpack-dev-middleware 中的 函数在通过测试遍历防护（traversal guard）后，以固定的字符偏移量对请求路径名进行切片，从而将请求解析为本地文件。该防护机制依赖于 对 的应用，它仅匹配作为独立路径段出现的 ；而包含性检查则通过字符串比较 实现，最终文件路径由 构建。 当配置的 末尾不包含斜杠时，例如针对 发起请求 ，其路径名为 。其中，唯一的 位于路径段 内部，因此能够绕过防护检测；然而，基于偏移量的切片操作会在该路径段中间截断，导致向 传入 ，从而将文件解析到 上一级目录中。 要从

CVSS 7.4 · High EPSS 0.37% · P30

Possible ATT&CK Techniques 1 AI

T1564.004 · NTFS File Attributes

Affected Version Matrix 4

VendorProduct Version RangeStatus
webpack webpack-dev-middleware 5.3.4≤ 5.3.4 affected
6.1.2≤ 6.1.3 affected
7.1.0≤ 7.4.5 affected
8.0.0≤ 8.1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76844

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath
Source: CVE Program / CVE List V5
Vulnerability Description
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
webpack webpack-dev-middleware 5.3.4 ~ 5.3.4 -

II. Public POCs for CVE-2026-76844

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 10988 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-76844

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-76844 (2)

IV. Related Vulnerabilities

Same product: webpack-dev-middleware
Same vendor: webpack
Same weakness: CWE-22

V. Comments for CVE-2026-76844

No comments yet

Leave a comment