Search: CVE-2026-76844

CVE-2026-76844 is a high-severity path traversal vulnerability in webpack-dev-middleware. It arises from improper pathname validation when the configured publicPath lacks a trailing slash, allowing crafted requests to bypass traversal guards and access files outside the intended directory. This vulnerability affects versions starting from 5.3.4, 6.1.2, 7.1.0, and later up to 8.1.1. The issue is a partial regression of a previous vulnerability (CVE-2024-29180) and requires the middleware to be backed by a physical filesystem to be exploitable. No official patch or remediation guidance is currently provided.