Path Traversal Vulnerability in webpack-dev-middleware by Webpack

CVE-2026-76844

What is CVE-2026-76844?

The webpack-dev-middleware is vulnerable to a path traversal issue where the request pathname can circumvent restrictions and allow access to unauthorized files. This occurs due to an incomplete security guard that incorrectly verifies paths against malicious inputs, especially when the configured publicPath lacks a trailing slash. Attackers can exploit this through crafted requests, potentially gaining access to sensitive files outside the intended directory. Mitigation strategies include ensuring publicPath configurations end with a trailing slash and keeping middleware updated to the latest secure version.

References