CVE-2026-76844: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in webpack webpack-dev-middleware

The vulnerability in webpack-dev-middleware occurs because the pathname validation logic only matches '..' as a whole path segment and slices the pathname at a fixed offset. When publicPath is configured without a trailing slash, requests like GET /assets../.env can bypass the traversal guard since '..' is embedded inside a segment and not detected. The slicing then extracts '../.env', which path.join resolves to a directory above the intended outputPath. Exploitation requires the middleware to use a physical filesystem (writeToDisk=true or custom outputFileSystem) since the default in-memory filesystem does not hold arbitrary files. The traversal depth is limited to one directory due to URL parsing collapsing dot-dot segments. This vulnerability is present in all releases from 5.3.4, 6.1.2, 7.1.0 onward, including 8.x versions, and represents an incomplete fix of CVE-2024-29180.

An attacker can craft a specially formed request to access files outside the intended directory served by webpack-dev-middleware, potentially exposing sensitive files on the server filesystem. This can lead to information disclosure if the middleware is configured to write to disk or uses a custom output filesystem that reflects the physical filesystem. The vulnerability does not require privileges or user interaction beyond sending a crafted HTTP request. The traversal depth is limited to one directory above the output path.

No official patch or remediation level is currently documented. Users should verify their publicPath configuration to ensure it includes a trailing slash to prevent bypass of the traversal guard. Additionally, avoid enabling writeToDisk or using a custom outputFileSystem that exposes the physical filesystem unless necessary. Monitor vendor advisories for updates or patches addressing this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.