npmPackage

webpack-dev-middleware

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-76844
Affects 0.5.0 to 7.4.5 (7.4.6 is outside it); 8.0.0 to 8.2.0 (8.3.0 is outside it)
CVE-2024-29180
Affects 0.5.0 to 5.3.3 (5.3.4 is outside it); 6.0.0 to 6.1.1 (6.1.2 is outside it); 7.0.0 (7.1.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-76844High 8.3
zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
Affected: from 8.0.0, fixed in 8.3.0; fixed in 7.4.6.
Fixed in 7.4.6 (released Sep 3, 2026, 10 days after disclosure) and 8.3.0 (released Sep 3, 2026, 10 days after disclosure).
The latest release, 8.6.0, is not affected.
87% of webpack-dev-middleware downloads last week were affected versions (31.1M).
CVE-2024-29180High 7.4
webpack-dev-middleware Path Traversal vulnerability
Affected: from 7.0.0, fixed in 7.1.0; from 6.0.0, fixed in 6.1.2; fixed in 5.3.4.
Fixed in 5.3.4 (released Mar 20, 2024, 1 day before disclosure), 6.1.2 (released Mar 20, 2024, 1 day before disclosure) and 7.1.0 (released Mar 19, 2024, 2 days before disclosure).
The latest release, 8.6.0, is not affected.
21% of webpack-dev-middleware downloads last week were affected versions (7.4M).