Executive brief
webpack-dev-middleware is a development tool that serves built application files to developers during the build process. A flaw in how it parses file requests allows attackers to bypass security checks and read arbitrary files from a developer's machine, such as environment configuration files, private keys, or source code. This risk is highest when the development server is accessible over a network or from untrusted web pages.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the getFilenameFromUrl function. When the configured publicPath lacks a trailing slash, a crafted URL like GET /assets../.env against publicPath /assets can bypass the UP_PATH_REGEXP guard (which only matches ".." as complete path segments) while still allowing directory traversal through the string slice operation. The vulnerable code builds file paths via path.join(outputPath, pathname.slice(publicPathPathname.length)), which concatenates a malicious "../" segment extracted from the URL. Exploitation requires writeToDisk to be true or a custom outputFileSystem to be supplied; the default in-memory filesystem is unaffected. This is a regression from an incomplete patch to CVE-2024-29180 affecting versions 5.3.4+, 6.1.2+, and 7.1.0+. Attack vectors are network-based with no authentication or special privileges required, though user interaction may be involved depending on deployment.
Affected products
- webpack webpack-dev-middleware 5.3.4 and later (5.x); 6.1.2 and later (6.x); 7.1.0 and later (7.x)
Timeline
- 2026-08-24: disclosed