CVE-2026-76844: webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize(./${pathname}), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the fix for CVE-2024-29180: requests to webpack-dev-middleware should be validated by the traversal guard (UP_PATH_REGEXP) and must use a correct containment check and offset slicing logic when slicing at publicPathPathname length, especially when publicPath is not slash-terminated, to prevent GET requests like /assets../.env from resolving outside the outputPath.
Event History
Frequently Asked Questions
Which deployments are exposed to file disclosure?
Exposure requires a publicPath configured without a trailing slash and middleware access to the physical filesystem. Physical filesystem access occurs when writeToDisk is true or when a custom outputFileSystem is supplied; the default memfs volume contains only build output.
What does an attacker need to send?
An unauthenticated network request can use a path that begins with the configured publicPath but embeds the traversal sequence at the segment boundary created by offset slicing, such as /assets../.env when publicPath is /assets. The supplied vector indicates no privileges are required, while user interaction is required.
How far can the traversal reach?
The traversal is limited to one directory above outputPath. A separately delimited dot-dot segment is collapsed during path normalization, preventing deeper traversal through additional normal dot-dot segments.
How can I identify potentially affected configurations before patching?
Review webpack-dev-middleware configuration for a publicPath that lacks a trailing slash together with writeToDisk enabled or a custom outputFileSystem. Requests whose paths resemble the configured publicPath immediately followed by "../", such as /assets../.env, are relevant indicators to review in request logs.