Description
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
Published: 2026-08-24
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Heap Buffer Overflow (potential Remote Code Execution)
Action: Immediate Patch
AI Analysis

Impact

The zlib library, in releases from 1.2.11 through 1.3.2, contains a heap buffer overflow that is triggered after an attempted write operation fails. When the underlying write returns an error, the gz_write function does not reset the stream’s next_in pointer, leaving it pointing to the caller’s buffer. Subsequent gz* calls then compute a cache position from this stale pointer and write past the allocated heap space. The flaw is categorized as CWE-787, indicating an uncontrolled write to a buffer.

Affected Systems

The affected product is the zlib compression library itself. All releases from 1.2.11 up to and including 1.3.2 contain the vulnerability. Any application that links against these versions and performs GZIP or ZIP compression or decompression may be impacted. Versions newer than 1.3.2, or forks that have applied the patch, are not affected.

Risk and Exploitability

The vulnerability has a CVSS score of 8.3, denoting high severity, and an EPSS score of less than 1%, indicating a low frequency of exploitation at present. It is not listed in the CISA KEV catalog. An attacker can induce a write failure by sending malformed input or abruptly terminating a socket connection to a process using the library. If the attacker can control the payload after the failure, the overflow could lead to arbitrary code execution, denial of service, or a crash of the affected process. The exact threat depends on how the library is integrated and the presence of runtime memory protection measures.

Generated by OpenCVE AI on October 1, 2026 at 22:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the zlib library to a version that contains the fix; the vulnerability exists through 1.3.2.
  • If upgrading immediately is not possible, ensure that any gz_write error is followed by a call to gzclearerr() and that the affected stream is not reused until the error state is cleared, thus avoiding the stale pointer issue.
  • Compile the application with memory safety protections such as stack canaries, address space layout randomization, and enabled ASLR to reduce the risk that the heap override results in code execution.

Generated by OpenCVE AI on October 1, 2026 at 22:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-g84c-rxfj-3j2c webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
History

Thu, 01 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem. zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
Title webpack-dev-middleware before 7.4.6 and 8.3.0 Path Traversal via Non-Slash-Terminated publicPath zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
First Time appeared Zlib
Zlib zlib
Weaknesses CWE-787
CPEs cpe:2.3:a:webpack.js:webpack-dev-middleware:*:*:*:*:*:*:*:* cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*
Vendors & Products Zlib
Zlib zlib
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Thu, 01 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward. webpack-dev-middleware 5.3.4, 6.1.2 through 6.1.3, 7.1.0 before 7.4.6, and 8.0.0 before 8.3.0 contains a path traversal vulnerability in getFilenameFromUrl that bypasses the fix for CVE-2024-29180: a publicPath without a trailing slash is matched by string prefix, and the '..' guard runs before that prefix is stripped. Unauthenticated attackers can request a path such as /assets../secret to read files one directory above the output directory when the middleware serves from the physical filesystem through writeToDisk or a custom outputFileSystem.
Title webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath webpack-dev-middleware before 7.4.6 and 8.3.0 Path Traversal via Non-Slash-Terminated publicPath
References

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Description webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.
Title webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath
First Time appeared Webpack.js
Webpack.js webpack-dev-middleware
Weaknesses CWE-22
CPEs cpe:2.3:a:webpack.js:webpack-dev-middleware:*:*:*:*:*:*:*:*
Vendors & Products Webpack.js
Webpack.js webpack-dev-middleware
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Webpack.js Webpack-dev-middleware
Zlib Zlib
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-01T11:03:59.221Z

Reserved: 2026-08-19T20:34:19.724Z

Link: CVE-2026-76844

cve-icon Vulnrichment

Updated: 2026-08-26T18:22:40.939Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T14:17:02.250

Modified: 2026-10-01T12:17:16.387

Link: CVE-2026-76844

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-24T13:12:01Z

Links: CVE-2026-76844 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T22:45:13Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-787

    Out-of-bounds Write