Description
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vitejs | vite | >= 8.0.0, < 8.0.5, >= 7.1.0, < 7.3.2 | — |
| vitejs | vite-plus | < 0.1.16 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | vite | 8.0.11-r0 | — |
| Wolfi rolling | vitess-23 | 23.0.3-r11 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Vite Dev Server - Directory Traversal http/cves/2026/CVE-2026-39364.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | vite | >= 8.0.0, < 8.0.5 | 8.0.5 | GHSA-v2wj-q39q-566r |
| npm | vite | >= 7.1.0, < 7.3.2 | 7.3.2 | GHSA-v2wj-q39q-566r |