8.3
HIGH
CVSS 4.0
CVE-2026-76844
zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
Overview
Description
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
Details
INFO
Published Date :
Aug. 24, 2026, 2:17 p.m.
Last Modified :
Oct. 12, 2026, 5:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Impact
Affected Products
The following products are affected by CVE-2026-76844
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
Update webpack-dev-middleware to patch the path traversal vulnerability.
- Update webpack-dev-middleware to the latest version.
- Ensure writeToDisk is false or not using custom outputFileSystem.
- Configure publicPath with a trailing slash if possible.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-76844.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-76844 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-76844
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-76844 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-76844 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: webpack-dev-middleware de webpack, Description: zlib 1.2.11 hasta 1.3.2 contiene un desbordamiento de búfer de montón: después de que falle una llamada subyacente a write(), gz_write() retorna sin restablecer strm.next_in, dejándolo apuntando al búfer del llamador. Una llamada posterior de escritura gz entonces deriva una posición a partir del puntero obsoleto y escribe más allá de una asignación de montón; cualquier fallo de write() lo alcanza, incluyendo EPIPE en un descriptor de bloqueo, y en versiones anteriores a la 1.3.1.2 la escritura fallida debe ir seguida de una llamada a gzclearerr(). -
CVE Modified by [email protected]
Oct. 01, 2026
Action Type Old Value New Value Changed Description webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem. zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call. Added CVSS V4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Removed CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Added CWE CWE-787 Removed CWE CWE-22 Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/76xxx/CVE-2026-76844.json">CVE-2026-76844</a> Added Reference https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490 Added Reference https://github.com/madler/zlib Added Reference https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393 Added Reference https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148 Added Reference https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate Removed Reference https://github.com/advisories/GHSA-wr3j-pwj9-hqq6 Removed Reference https://github.com/webpack/webpack-dev-middleware Removed Reference https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js Removed Reference https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b Removed Reference https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b Removed Reference https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6 Removed Reference https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0 Removed Reference https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c Removed Reference https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath -
CVE Modified by [email protected]
Oct. 01, 2026
Action Type Old Value New Value Changed Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward. webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem. Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/76xxx/CVE-2026-76844.json">CVE-2026-76844</a> Added Reference https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b Added Reference https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b Added Reference https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6 Added Reference https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0 Added Reference https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c -
CVE Modified by [email protected]
Aug. 26, 2026
Action Type Old Value New Value Added Reference https://github.com/advisories/GHSA-wr3j-pwj9-hqq6 Added Reference https://github.com/webpack/webpack-dev-middleware Added Reference https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js Added Reference https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath Removed Reference https://github.com/advisories/GHSA-wr3j-pwj9-hqq6 Removed Reference https://github.com/webpack/webpack-dev-middleware Removed Reference https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js Removed Reference https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 26, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-76844', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-26T18:22:33.313523Z'} -
New CVE Received by [email protected]
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'webpack', 'product': 'webpack-dev-middleware', 'versions': [{'status': 'affected', 'version': '5.3.4', 'versionType': 'semver', 'lessThanOrEqual': '5.3.4'}, {'status': 'affected', 'version': '6.1.2', 'versionType': 'semver', 'lessThanOrEqual': '6.1.3'}, {'status': 'affected', 'version': '7.1.0', 'versionType': 'semver', 'lessThanOrEqual': '7.4.5'}, {'status': 'affected', 'version': '8.0.0', 'versionType': 'semver', 'lessThanOrEqual': '8.1.1'}], 'packageURL': 'pkg:npm/webpack-dev-middleware', 'packageName': 'webpack-dev-middleware', 'collectionURL': 'https://www.npmjs.com/package/webpack-dev-middleware', 'defaultStatus': 'unaffected'}] Added Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Added CWE CWE-22 Added Reference https://github.com/advisories/GHSA-wr3j-pwj9-hqq6 Added Reference https://github.com/webpack/webpack-dev-middleware Added Reference https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js Added Reference https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.