CVE-2026-76844: Path Traversal in webpack-dev-middleware via Incomplete Prefix Validation

webpack-dev-middleware is an essential Node.js package that serves assets emitted from a Webpack compiler. It is frequently integrated within development servers like webpack-dev-server to stream assets directly to client browsers during local development cycles.

To ensure proper performance and capability, the middleware exposes an HTTP-accessible surface where requested URIs are dynamically mapped to local files. The mapping logic evaluates raw incoming paths, verifies access permissions, and handles the retrieval of output artifacts. This behavior exposes a critical attack surface if access checks are bypassed.

CVE-2026-76844 represents an incomplete remediation of CVE-2024-29180. Under specific conditions—such as a configuration lacking a trailing slash on the virtual resource path coupled with direct disk-write settings—an unauthenticated network attacker can leverage structured path requests to read local system configuration files situated above the output directory root.

The root cause of this vulnerability lies in the sequence of input verification and path truncation logic implemented in getFilenameFromUrl. The middleware evaluates if an incoming URI path starts with the specified virtual root directory (publicPath) and tests the raw input string against a validation regular expression (UP_PATH_REGEXP).

This regular expression only detects parent traversal sequences (..) when they are delimited as isolated directory segments (such as /../). If the double dot sequence is nested inside an arbitrary string sequence, it passes this validation check untouched.

When a publicPath is configured without a trailing slash (e.g., /assets), a request targeting /assets../.env evaluates as starting with the prefix /assets. The traversal guard examines the string /assets../.env and permits the request because the string segment assets.. does not match the standalone double-dot pattern.

Following the guard bypass, the application slices the raw path by the exact length of the publicPath prefix (7 characters). This slicing converts /assets../.env into the relative string ../.env, which is subsequently joined with the physical output path, escaping the designated asset sandbox.

The flawed logic is located within the request-handling middleware files where output file paths are derived from URLs. Below is a representation of the vulnerable path derivation flow.

// VULNERABLE CODE PATH
const UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
 
function getFilenameFromUrl(context, url) {
  const pathname = parseUrl(url);
  
  // Check if pathname starts with the public path
  if (pathname.startsWith(publicPathPathname)) {
    // Ensure the raw path has no explicit traversal sequences
    if (UP_PATH_REGEXP.test(pathname)) {
      throw new Error('Forbidden');
    }
    
    // Slicing here strips the prefix and yields relative traversal characters
    const remainder = pathname.slice(publicPathPathname.length);
    const filename = path.join(outputPath, remainder);
    return filename;
  }
}

The fundamental mitigation checks the validity of the computed absolute filepath rather than trying to sanitize the un-stripped request string. This is accomplished using path.relative to enforce folder containment boundaries.

// PATCHED IMPLEMENTATION
const filename = path.join(outputPath, pathname.slice(publicPathPathname.length));
 
// Compute path relative to the defined output root
const relative = path.relative(outputPath, filename);
 
// If the relative path points upwards (..), block the request
if (
  relative === ".." ||
  relative.startsWith(`..${path.sep}`) ||
  path.isAbsolute(relative)
) {
  throw new FilenameError("Forbidden", 403);
}

By comparing the output directory with the final resolved filename, the middleware accurately identifies if the resolved file resides outside the boundaries of the output path. This boundary enforcement renders string manipulation tricks irrelevant.

Exploitation of CVE-2026-76844 is direct and requires no prior authentication. However, successful retrieval of arbitrary files relies on several configuration prerequisites.

First, the virtual path prefix (publicPath) must be configured to omit a trailing slash (for example, /static instead of /static/). Second, the middleware must execute file reads against a physical disk rather than an in-memory buffer. This condition is satisfied when developers enable the writeToDisk option or pass a native physical file system as the outputFileSystem property.

An attacker sends a formatted HTTP request targeting the root path prefix followed by a double dot sequence and the target filename:

GET /static../.env HTTP/1.1
Host: target-dev-server:8080
Connection: close

Because the browser or client routing libraries collapse paths prior to server-side interpretation, the exploitation is strictly limited to reading files situated exactly one level above the compiled asset output root. Deep traversal via nested paths (e.g. ../../) is neutralized during the standard URL parsing pipeline.

This vulnerability exposes high-value intellectual property and configuration secrets stored on development machines and server nodes. Since development environments routinely hold unencrypted environment files (.env), AWS credentials, and database connection strings inside the parent project folder, a single file disclosure can lead to broader infrastructure compromise.

The vulnerability is designated a CVSS v3.1 score of 7.4 (High), with high confidentiality impact. Because the vulnerability permits directory escaping, the Scope metric is evaluated as Changed, indicating that the impact extends beyond the sandboxed memory execution environment of the webpack compilation.

Although the threat of automated internet-wide exploitation is limited by the typical localized deployments of development servers, the exploit is trivial to execute. Remote attackers targeting corporate intranets or phishing developers to execute cross-site requests can successfully exfiltrate sensitive credentials.

Remediation requires upgrading the underlying dependency to a version containing the post-resolution containment check. The patch was backported and released in versions 7.4.6 and 8.3.0.

If upgrading is not an immediate option, developers can apply an effective configuration-based workaround. Modifying the publicPath property in the Webpack configuration to include a trailing slash prevents the slice bypass.

// WORKAROUND CONFIGURATION
module.exports = {
  output: {
    // Terminating with a slash isolates prefix comparisons
    publicPath: '/assets/',
  },
};

When a trailing slash is appended, a request targeting /assets../.env fails the pathname.startsWith('/assets/') validation step entirely. The middleware will not process the request as matching the public asset scope, neutralizing the traversal vector.