CVE-2026-76844
CVE-2026-76844 · zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
This page contains facts from public vulnerability sources. Check the original advisory before updating.
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
CVSS 8.3 · High · EPSS 0.6% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
zlib
- Versions
- ≥ 1.2.11, ≤ 1.3.2: Affected (custom)
No fix published
webpack-dev-middleware npm
- Affected ranges
- SEMVER: ≥ 8.0.0, < 8.3.0
Update to 8.3.0
webpack-dev-middleware npm
- Affected ranges
- SEMVER: < 7.4.6
Update to 7.4.6
Original sources
- https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
- https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148
- https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
- https://github.com/madler/zlib
- https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate
- https://nvd.nist.gov/vuln/detail/CVE-2026-76844