Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vitejs | vite | >= 8.0.0, < 8.0.5, >= 7.0.0, < 7.3.2, >= 6.0.0, < 6.4.2 | — |
| vitejs | vite-plus | < 0.1.16 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | langfuse-3-worker | 3.164.0-r5 | — |
| Wolfi rolling | vite | 8.0.11-r0 | — |
| Wolfi rolling | vitess-23 | 23.0.3-r11 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Vite Dev Server - Path Traversal in Optimized Deps .map Handling http/cves/2026/CVE-2026-39365.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | vite | >= 8.0.0, < 8.0.5 | 8.0.5 | GHSA-4w7w-66w2-5vf9 |
| npm | vite | >= 7.0.0, < 7.3.2 | 7.3.2 | GHSA-4w7w-66w2-5vf9 |
| npm | vite | < 6.4.2 | 6.4.2 | GHSA-4w7w-66w2-5vf9 |