Address the vulnerability about webpack-dev-middleware

[DanielRuf]

I wonder if people use dev tools in production, or what justifies to patch even more versions?
Just curious because you can never have 0 vulnerabilities in your dev tools: https://overreacted.io/npm-audit-broken-by-design/

I have to deal with CVEs on a daily basis at work, and there we can and will not patch every problem, especially in dev tools. When we use CVSS v4 and EPSS as part of correct risk management, most findings often pose no real risk - unless you use dev tools on a production server.

[DanielRuf]

Should be already patched:

[alexander-akait]

Already fixed, the answer above, thank you

[rumpnizz]

I'm not sure this is properly fixed for 6.1.2.
Looking at the version6-middleware.js#L103, extra isn't passed to getFilenameFromUrl

This compared to the other versions version5-middleware.js#L104 and latest-middleware.js#L184.
Or is it handled differently in 6.1.2?

[alexander-akait]

@rumpnizz yeah, good catch 👍

[navalamol]

Hi Team, Can we get this patched in version 3 & 4 as well ?
3.7.3 & 4.3.0 are also widely used libraries. As they are transitive dependencies which further rely on previous node versions. So possibly these are also in use.

It would be great if we can patch fix in above versions

[alexander-akait]

We use ~ eveywhere, so you can update deps locally

[navalamol]

I understand that but we are enforced to use 3.x.x & 4.x.x versions of webpack-dev-middleware due to certain limitations.

You have provided a patch for 5.x.x, 6.x.x & 7.x.x versions. So my request was to provide patch for 3.x.x & 4.x.x versions. Thanks

[alexander-akait]

They are outdated, anyway I can accept your PR to patch them

[DanielRuf]

To quote from the linked GHSA entry:

If the development server is listening on a public IP address (or 0.0.0.0), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port).

If

• your OS exposes all ports to the outside
• AND your router allows accessing devices from the outside via any port (port forwarding)

then you have basically two dangerous and not recommended misconfigurations, which pose even higher risks.