webpack-dev-middleware vulnerabilities

2 known vulnerabilities in webpack-dev-middleware from Webpack. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  webpack-dev-middleware: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-76844Aug 24, 2026Webpack

  webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string pre

• 7.5 High severity

  webpack-dev-middleware: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-29180Mar 21, 2024WebpackEPSS 1.23%

  Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The