CVE-2026-76844
CVE-2026-76844: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh8.6
High [CVE-2026-76844] Information Disclosure via Path Traversal
CVE-2026-76844Source published Source updated
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env"…
- Affected products in this advisory
- Red Hat Data Grid 8.6.3
- Red Hat Discovery 2
- Red Hat Migration Toolkit 1.8
- Node HealthCheck Operator
11 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- redhat-datagrid-maven-repository.zip
- discovery/discovery-ui-rhel9:1788206196
- rhmtc/openshift-migration-ui-rhel8:1789546373
- RHSA-2026:69296
2 more entries in the full advisory.
- Mitigation guidance
- Ensure that the configured publicPath always ends with a trailing slash (e.g., '/assets/'), or utilize the default setting ('auto'), which resolves to '/' and is unmitigated by default. Alternatively, avoid backing the middleware with a physical filesystem (writeToDisk: false).
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.