VulnSocial

CVE-2026-76844Patch

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-03); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-03: 1Mentions · 2026-09-29: 1Patch / Workaround · 2026-09-03: 1Technical Details · 2026-09-29: 109-0309-29
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-031
Patch1
2026-09-291
Disclosure1
Full discourse2 posts
  • Ulises Gascón@kom_256
    Patch

    CVE-2026-76844 for webpack-dev-middleware was published by VulnCheck without coordinating with the maintainers or the OpenJS Foundation CNA, which holds CNA scope for webpack, and before any fix existed. The coordinated advisory and fix are now out https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c

    Post summary

    The post announces that a coordinated advisory and patch for CVE-2026-76844 in webpack-dev-middleware have been released, providing the advisory link.

    02030313
    5.5K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔵 webpack-dev-middleware, Path Traversal, #CVE-2026-76844 -DC-Sep2026-2606 https://dailycve.com/webpack-dev-middleware-path-traversal-cve-2026-76844-dc-sep2026-2606/

    Post summary

    The tweet discloses a path traversal vulnerability in webpack-dev-middleware (CVE-2026-76844) and links to a details page, without mentioning exploits, patches, or active exploitation.

    0000029
    238 followersView on X

Explore more

Back to dashboard