Path Traversal in webpack-dev-middleware

Successful exploitation permits unauthorized reading and exfiltration of files from the developer machine when the middleware serves from the physical filesystem. A network-reachable development server can be attacked directly by a local-network attacker when bound to a public interface. If the server permits cross-origin access, a malicious website may induce a victim browser to request and exfiltrate files from the local development server.

Until updated, avoid physical filesystem-backed operation by disabling writeToDisk where feasible and avoiding custom physical outputFileSystem configurations. Bind development servers only to localhost, do not expose them on public or untrusted network interfaces, and restrict cross-origin access to trusted origins. URL-decode and normalize untrusted paths before validation, resolve canonical paths, and enforce that the resolved target remains within the intended output directory.

Upgrade webpack-dev-middleware to version 5.3.4 or later in the 5.x branch, 6.1.2 or later in the 6.x branch, or 7.1.0 or later in the 7.x branch. Fixed releases URL-decode and normalize the pathname before further file-path processing. Update products that bundle the vulnerable dependency using their applicable vendor security updates.