Detections
Analytics

SCA: security update for webpack-dev-middleware (GHSA-g84c-rxfj-3j2c)

high Tenable Cloud Security Plugin ID 448485

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request
 pathname against a traversal guard and then slicing it at a fixed character offset. The guard,
 UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path
 segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and
 the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the
 configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath
 /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so
 passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join,
 resolving one directory above outputPath. Reading a file from that path requires the middleware to be
 backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is
 supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single
 directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard
 runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete
 fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every
 release from 5.3.4, 6.1.2 and 7.1.0 onward. (CVE-2026-76844)

Solution

Update the webpack-dev-middleware library and its related packages to version 7.4.6 or later.

See Also

https://github.com/advisories/GHSA-g84c-rxfj-3j2c

Plugin Details

Severity: High

ID: 448485

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/29/2026

Updated: 9/29/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 50.81

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-76844

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 5.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/29/2026

Vulnerability Publication Date: 8/24/2026

Reference Information

CVE: CVE-2026-76844

cwe: CWE-22