CVE-2026-76844

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
https://github.com/madler/zlib
https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148
https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate

Configurations

No configuration.

History

12 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) zlib 1.2.11 hasta 1.3.2 contiene un desbordamiento de búfer de montón: después de que falle una llamada subyacente a write(), gz_write() retorna sin restablecer strm.next_in, dejándolo apuntando al búfer del llamador. Una llamada posterior de escritura gz entonces deriva una posición a partir del puntero obsoleto y escribe más allá de una asignación de montón; cualquier fallo de write() lo alcanza, incluyendo EPIPE en un descriptor de bloqueo, y en versiones anteriores a la 1.3.1.2 la escritura fallida debe ir seguida de una llamada a gzclearerr().

01 Oct 2026, 12:17

Type	Values Removed	Values Added
CWE	~~CWE-22~~	CWE-787
References	~~{'url': 'https://github.com/advisories/GHSA-wr3j-pwj9-hqq6', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://github.com/webpack/webpack-dev-middleware', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath', 'source': 'disclosure@vulncheck.com'}~~	() https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490 - () https://github.com/madler/zlib - () https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393 - () https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148 - () https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate -
Summary	(en) webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem.	(en) zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

01 Oct 2026, 11:17

Type	Values Removed	Values Added
Summary	(en) webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.	(en) webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem.
References		() https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b - () https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b - () https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6 - () https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0 - () https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c -

Information

Published : 2026-08-24 14:17

Updated : 2026-10-12 17:10

NVD link : CVE-2026-76844

Mitre link : CVE-2026-76844

CVE.ORG link : CVE-2026-76844

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

7.4 /10