npm webpack-dev-middleware vulnerabilities

Latest npm webpack-dev-middleware CVEs

Newest publication first

1. CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

   Published 2026-08-24

   High·CVSS 8.3 EPSS 0.59%

   zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap...

2. CVE-2024-29180 webpack-dev-middleware Path Traversal vulnerability

   Published 2024-03-21

   High·CVSS 7.5 EPSS 1.2%

   Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can eithe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.