CVE-2026-76844 webpack CVE debrief

Who should care

Developers and administrators using webpack-dev-middleware in their applications should assess their exposure and take necessary actions to prevent potential exploitation. This includes verifying and updating their webpack-dev-middleware configuration to prevent exploitation and monitoring for suspicious requests.

Why it matters

CVE-2026-76844 is a path traversal vulnerability in webpack-dev-middleware that allows attackers to access files outside the intended directory. Developers and administrators should assess their exposure and take necessary actions to prevent potential exploitation.

• attackers may be able to access sensitive files outside the intended directory
• developers and administrators need to verify and update their webpack-dev-middleware configuration to prevent exploitation
• the vulnerability requires the middleware to be backed by the physical filesystem, which may not be the case in all deployments

Technical summary

The vulnerability is caused by the improper handling of the publicPath in webpack-dev-middleware. When the publicPath does not end with a slash, an attacker can craft a request that bypasses the traversal guard and accesses files outside the intended directory. The traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. This issue requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied.

Defensive priority

High

Recommended defensive actions

• Update webpack-dev-middleware to the latest version
• Ensure publicPath is properly configured and terminated with a slash
• Monitor for suspicious requests to prevent potential exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the improper handling of the publicPath in webpack-dev-middleware. When the publicPath does not end with a slash, an attacker can craft a request that bypasses the traversal guard and accesses files outside the intended directory. The default publicPath value of 'auto' resolves to '/' and is not affected. This issue requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.