Go to packages list

webpack-dev-middleware

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 3HighAffects 6 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High3 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting webpack-dev-middleware, based on data from OSV.

Vulnerabilities affecting webpack-dev-middleware
IDSeveritySummaryAffected versionsPublishedSource
GHSA-g84c-rxfj-3j2cHighwebpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath> [!IMPORTANT] > CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were notified before publication, and no fix was available at that time. This advisory is the coordinated record produced by the webpack maintainers and the OpenJS Foundation CNA. ### Impact `webpack-dev-middleware` resolves a request to a local file in `getFilenameFromUrl`. When the configured `publicP
  • >= 8.0.0, < 8.3.0
  • < 7.4.6
GitHub (opens in a new tab)
GHSA-p3f5-w63m-mxphHighDuplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references. ## Original Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the
  • all
GitHub (opens in a new tab)
GHSA-wr3j-pwj9-hqq6HighPath traversal in webpack-dev-middleware### Summary _The **webpack-dev-middleware** middleware does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine._ ### Details The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory _memfs_ filesystem. If _writeToDisk_ configuration option is set to **true**, the physical filesystem is used: [https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/setupOutputFileSystem.js#L21](https://git
  • >= 7.0.0, < 7.1.0
  • >= 6.0.0, < 6.1.2
  • < 5.3.4
GitHub (opens in a new tab)
  • GHSA-g84c-rxfj-3j2cHigh
    webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
    • >= 8.0.0, < 8.3.0
    • < 7.4.6
    GitHub (opens in a new tab)

    > [!IMPORTANT] > CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were notified before publication, and no fix was available at that time. This advisory is the coordinated record produced by the webpack maintainers and the OpenJS Foundation CNA. ### Impact `webpack-dev-middleware` resolves a request to a local file in `getFilenameFromUrl`. When the configured `publicP

    CVE: CVE-2026-76844

  • GHSA-p3f5-w63m-mxphHigh
    Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
    • all
    GitHub (opens in a new tab)

    ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references. ## Original Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the

  • GHSA-wr3j-pwj9-hqq6High
    Path traversal in webpack-dev-middleware
    • >= 7.0.0, < 7.1.0
    • >= 6.0.0, < 6.1.2
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 7.0.0, < 7.1.0
    • >= 6.0.0, < 6.1.2
    • < 5.3.4

    ### Summary _The **webpack-dev-middleware** middleware does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine._ ### Details The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory _memfs_ filesystem. If _writeToDisk_ configuration option is set to **true**, the physical filesystem is used: [https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/setupOutputFileSystem.js#L21](https://git

    CVE: CVE-2024-29180

Showing 1-3 of 3 vulnerabilities