Path traversal in webpack-dev-middleware

Description

No description available.

Recommendation

Update the webpack-dev-middleware package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 5.3.3

  >= 6.0.0, < 6.1.2

  >= 7.0.0, < 7.1.0**

• Patched version(s): **5.3.4

  6.1.2

  7.1.0**

References

• GHSA-wr3j-pwj9-hqq6
• CVE-2024-29180
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal - CVE-2024-50336
• mapshaper Path Traversal vulnerability - CVE-2024-1163
• i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters - CVE-2026-41690
• Nuxt Devtools has a Path Traversal: '../filedir - CVE-2024-23657

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

webpack-dev-middleware