Description

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-24T14:17:02.250Z",
  "pubdate": "2026-08-24T14:17:02.250Z",
  "executiveSummary": "webpack-dev-middleware contains a path traversal vulnerability that arises from an incomplete fix for CVE-2024-29180. The vulnerability allows an unauthorized remote attacker to read arbitrary files from the host system, restricted to a single directory level above the configured output path.\nThe flaw affects webpack-dev-middleware in releases from 5.3.4, 6.1.2, and 7.1.0 onward. Exploitation requires specific conditions: the configured publicPath must lack a trailing slash, and the middleware must be backed by the physical filesystem via settings such as writeToDisk being enabled or through the use of a custom outputFileSystem, because the default memfs volume contains only build output.\nWhen successfully exploited, an attacker can construct specially crafted HTTP requests to traverse outside the intended web root and access sensitive local files, such as environment configuration files. The risk is mitigated when using the default publicPath value of \"auto\" which resolves to \"/\".",
  "technicalDetails": "The vulnerability resides in the getFilenameFromUrl function within webpack-dev-middleware, specifically in how it resolves requests to local files. The component evaluates the request pathname against a traversal guard known as UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), and subsequently performs a containment test using the string comparison pathname.startsWith(publicPathPathname) before constructing the file path using path.join(outputPath, pathname.slice(publicPathPathname.length)).\nThe root cause of the flaw is an improper offset calculation and inadequate input validation when the configured publicPath lacks a trailing slash. Specifically, a request such as GET /assets../.env against a publicPath of /assets results in the pathname /assets../.env. In this scenario, the dot-dot sequence is embedded within the segment \"assets..\" rather than existing as a whole path segment. As a result, the UP_PATH_REGEXP traversal guard fails to match it, allowing the input to bypass validation.\nDuring the subsequent slice operation, the offset calculation cuts directly within the \"assets..\" segment based on the length of publicPathPathname, passing the resulting string \"../.env\" directly to path.join. This causes path.join to resolve one directory level above the designated outputPath.\nThe attack flow proceeds as follows: an attacker sends a specially crafted HTTP GET request containing a malformed segment (e.g., /assets../.env) against an endpoint utilizing a vulnerable webpack-dev-middleware configuration lacking a trailing slash on the publicPath. The request bypasses the traversal guard because the dot-dot characters do not constitute a standalone path segment. The slicing mechanism extracts the relative traversal sequence, which is then concatenated with the output path. If the middleware is backed by the physical filesystem—enabled via writeToDisk or a custom outputFileSystem—the application reads and returns the targeted file from the parent directory. The traversal depth is strictly limited to a single directory level because standalone dot-dot segments are automatically collapsed during standard URL parsing prior to the execution of the guard."
}