Vulnerability-Lookup

CVE-2026-76844 (GCVE-0-2026-76844)

Vulnerability from cvelistv5 – Published: 2026-08-24 13:12 – Updated: 2026-10-01 11:03

Title

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

Summary

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:22 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://gist.github.com/thesmartshadow/e0b9481792…	technical-descriptionexploit
https://github.com/madler/zlib/commit/df84af25dc1…	patch
https://github.com/madler/zlib/blob/v1.3.2/gzwrit…	technical-description
https://github.com/madler/zlib	product
https://www.vulncheck.com/advisories/zlib-1.3.1.2…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
zlib	zlib	Affected: 1.2.11 , ≤ 1.3.2 (custom) cpe:2.3:a:zlib:zlib::::::::

Date Public

2026-09-02 00:00

Credits

Ali Firas (thesmartshadow) Michael Mullins

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76844",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:22:33.313523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:22:44.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/madler/zlib",
          "product": "zlib",
          "vendor": "zlib",
          "versions": [
            {
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "1.2.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3.2",
                  "versionStartIncluding": "1.2.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Firas (thesmartshadow)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Mullins"
        }
      ],
      "datePublic": "2026-09-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T11:03:59.221Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Technical report and proof of concept",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/madler/zlib"
        },
        {
          "name": "VulnCheck Advisory: zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "title": "zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76844",
    "datePublished": "2026-08-24T13:12:01.148Z",
    "dateReserved": "2026-08-19T20:34:19.724Z",
    "dateUpdated": "2026-10-01T11:03:59.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-76844",
      "date": "2026-10-01",
      "epss": "0.00483",
      "percentile": "0.39333"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:github/madler/zlib",
                "product": "zlib",
                "vendor": "zlib",
                "versions": [
                  {
                    "lessThanOrEqual": "1.3.2",
                    "status": "affected",
                    "version": "1.2.11",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "disclosure@vulncheck.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
          }
        ],
        "id": "CVE-2026-76844",
        "lastModified": "2026-10-01T12:17:16.387",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.2,
              "source": "disclosure@vulncheck.com",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "disclosure@vulncheck.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-76844",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:22:33.313523Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-24T14:17:02.250",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/madler/zlib"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-01T11:56:50+00:00",
      "cve": "CVE-2026-76844",
      "id": "CVE-2026-76844",
      "initial_release_date": "2026-08-24T13:12:01.148000+00:00",
      "product_status:fixed": "4",
      "product_status:known_affected": "25",
      "product_status:known_not_affected": "102",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76844.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-01T16:18:03Z",
      "cve": "CVE-2026-76844",
      "id": "CVE-2026-76844",
      "initial_release_date": "2026-08-27T16:50:25Z",
      "product_status:known_affected": "15",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-76844",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-76844.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-76844",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-26T18:22:33.313523Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-26T18:22:40.939Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:github/madler/zlib",
              "product": "zlib",
              "vendor": "zlib",
              "versions": [
                {
                  "lessThanOrEqual": "1.3.2",
                  "status": "affected",
                  "version": "1.2.11",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "1.3.2",
                      "versionStartIncluding": "1.2.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Ali Firas (thesmartshadow)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Michael Mullins"
            }
          ],
          "datePublic": "2026-09-02T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-01T11:03:59.221Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "name": "Technical report and proof of concept",
              "tags": [
                "technical-description",
                "exploit"
              ],
              "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
            },
            {
              "name": "Patch Commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://github.com/madler/zlib"
            },
            {
              "name": "VulnCheck Advisory: zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
            }
          ],
          "title": "zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write",
          "x_generator": {
            "engine": "vulncheck-endgame"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-76844",
        "datePublished": "2026-08-24T13:12:01.148Z",
        "dateReserved": "2026-08-19T20:34:19.724Z",
        "dateUpdated": "2026-10-01T11:03:59.221Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-380014

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:41

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:41:02.302394+00:00",
  "id": "EUVD-2026-380014"
}

FKIE_CVE-2026-76844

Vulnerability from fkie_nvd - Published: 2026-08-24 14:17 - Updated: 2026-10-01 12:17

Severity

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	disclosure@vulncheck.com	https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
	disclosure@vulncheck.com	https://github.com/madler/zlib
	disclosure@vulncheck.com	https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
	disclosure@vulncheck.com	https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148
	disclosure@vulncheck.com	https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/madler/zlib",
          "product": "zlib",
          "vendor": "zlib",
          "versions": [
            {
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "1.2.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
    }
  ],
  "id": "CVE-2026-76844",
  "lastModified": "2026-10-01T12:17:16.387",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "disclosure@vulncheck.com",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-76844",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T18:22:33.313523Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-24T14:17:02.250",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/madler/zlib"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Primary"
    }
  ]
}

GHSA-G84C-RXFJ-3J2C

Vulnerability from github – Published: 2026-09-29 16:59 – Updated: 2026-09-29 16:59

Summary

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

Details

[!IMPORTANT] CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were notified before publication, and no fix was available at that time. This advisory is the coordinated record produced by the webpack maintainers and the OpenJS Foundation CNA.

Impact

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl. When the configured publicPath has no trailing slash (for example /assets), a request that shares that prefix without being under it (for example /assets../secret) still passes the containment check, and the .. guard does not catch it because it runs on the path before the publicPath prefix is stripped. The stripped remainder then escapes the configured output directory once joined, so an unauthenticated request can read files outside the output root. Applications serving webpack-dev-middleware (directly or via webpack-dev-server) with a publicPath that does not end in a slash are affected. A development server reachable on the network can be attacked with a single request and no victim interaction.

Patches

Patched in webpack-dev-middleware 8.3.0. There is no backport to the 5.x, 6.x, or 7.x lines; users on those lines should upgrade to 8.3.0 or later.

Workarounds

Configure publicPath with a trailing slash (for example /assets/ instead of /assets), or upgrade to a patched version.

References

CVE-2024-29180 (GHSA-wr3j-pwj9-hqq6), the earlier path traversal in the same component that this issue bypasses.

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "webpack-dev-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 7.4.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "webpack-dev-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-76844"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-29T16:59:18Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "\u003e [!IMPORTANT]\n\u003e CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were notified before publication, and no fix was available at that time. This advisory is the coordinated record produced by the webpack maintainers and the OpenJS Foundation CNA.\n\n### Impact\n\n`webpack-dev-middleware` resolves a request to a local file in `getFilenameFromUrl`. When the configured `publicPath` has no trailing slash (for example `/assets`), a request that shares that prefix without being under it (for example `/assets../secret`) still passes the containment check, and the `..` guard does not catch it because it runs on the path before the `publicPath` prefix is stripped. The stripped remainder then escapes the configured output directory once joined, so an unauthenticated request can read files outside the output root. Applications serving `webpack-dev-middleware` (directly or via `webpack-dev-server`) with a `publicPath` that does not end in a slash are affected. A development server reachable on the network can be attacked with a single request and no victim interaction.\n\n### Patches\n\nPatched in `webpack-dev-middleware` 8.3.0. There is no backport to the 5.x, 6.x, or 7.x lines; users on those lines should upgrade to 8.3.0 or later.\n\n### Workarounds\n\nConfigure `publicPath` with a trailing slash (for example `/assets/` instead of `/assets`), or upgrade to a patched version.\n\n### References\n\n- [CVE-2024-29180](https://www.cve.org/CVERecord?id=CVE-2024-29180) ([GHSA-wr3j-pwj9-hqq6](https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6)), the earlier path traversal in the same component that this issue bypasses.",
  "id": "GHSA-g84c-rxfj-3j2c",
  "modified": "2026-09-29T16:59:18Z",
  "published": "2026-09-29T16:59:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76844"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/pull/2404"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/webpack/webpack-dev-middleware"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath"
}

MSRC_CVE-2026-76844

Vulnerability from csaf_microsoft - Published: 2026-10-02 01:02 - Updated: 2026-10-02 01:02

Summary

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

Scope

1 vulnerability in this advisory, including CVE-2026-76844.

CVE-2026-76844

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Known affected: 1 product

Open the full advisory

RHSA-2026:61783

Vulnerability from csaf_redhat - Published: 2026-08-31 21:39 - Updated: 2026-10-02 04:30

Summary

Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

Severity

Important

Scope

42 vulnerabilities in this advisory, including CVE-2026-76844.

CVE-2026-76844

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one directory above the intended output path. This could lead to information disclosure if the middleware is configured to use the physical filesystem.

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Fixed: 2 products Known not affected: 2 products

https://access.redhat.com/errata/RHSA-2026:61783

Open the full advisory

RHSA-2026:68681

Vulnerability from csaf_redhat - Published: 2026-09-17 14:19 - Updated: 2026-10-02 10:44

Summary

Red Hat Security Advisory: Red Hat Migration Toolkit for Containers

Severity

Important

Scope

34 vulnerabilities in this advisory, including CVE-2026-76844.

CVE-2026-76844

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Fixed: 1 product Known not affected: 10 products

https://access.redhat.com/errata/RHSA-2026:68681

Open the full advisory

RHSA-2026:69296

Vulnerability from csaf_redhat - Published: 2026-09-21 12:19 - Updated: 2026-10-02 01:17

Summary

Red Hat Security Advisory: Red Hat Data Grid 8.6.3 security update

Severity

Important

Scope

17 vulnerabilities in this advisory, including CVE-2026-76844.

CVE-2026-76844

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2026:69296

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-76844 (GCVE-0-2026-76844)

EUVD-2026-380014

FKIE_CVE-2026-76844

GHSA-G84C-RXFJ-3J2C

Impact

Patches

Workarounds

References

MSRC_CVE-2026-76844

RHSA-2026:61783

RHSA-2026:68681

RHSA-2026:69296

Tags

Sightings

Nomenclature

Related by attack behaviour