Executive brief
webpack-dev-middleware is a middleware for serving webpack-built files during development. A path traversal vulnerability allows attackers to bypass URL validation and read arbitrary files from a developer's machine, potentially exposing source code, credentials, and configuration files. Exploitation requires the writeToDisk option to be enabled and can occur via direct network access or through CORS-enabled cross-domain requests.
Technical details
The vulnerability is a path traversal (CWE-22) in the getFilenameFromUrl method, which constructs local file paths by stripping the public path prefix from a URL and appending the remainder to the output path. The method fails to unescape and normalize URL-encoded sequences such as %2e (.) and %2f (/), allowing an attacker to inject path traversal components. When writeToDisk is true, files are read from the physical filesystem rather than an in-memory cache, making the vulnerability exploitable. The attack requires network access to the development server but no authentication or special privileges; user interaction is only required if exploitation occurs via a malicious CORS request from a third-party domain. Patches are available in versions 5.3.4, 6.1.2, and 7.1.0.
Affected products
- webpack webpack-dev-middleware <= 5.3.3, 6.0.0-6.1.1, 7.0.0
CVE identifiers
- CVE-2026-76844
- CVE-2024-29180
Timeline
- 2024-03-21: disclosed: GHSA-wr3j-pwj9-hqq6 published
- 2024-03-21: patched: Fixes released in 5.3.4, 6.1.2, 7.1.0