Description
[!IMPORTANT] CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects.
Recommendation
Update the webpack-dev-middleware package to the latest compatible version. Followings are version details:
Affected version(s): **< 7.4.5 >= 8.0.0, < 8.3.0** Patched version(s): **7.4.6 8.3.0**
References
Could your website be exposed too?
SmartScanner can check your website for webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Path traversal in webpack-dev-middleware - CVE-2024-29180
- moment vulnerable to Path Traversal via crafted non-string locale name - CVE-2026-17495
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
- dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
You might also like:
See something that needs correcting? Let us knowUpdated September 29, 2026