CVE-2026-39364

Vite has a `server.fs.deny` bypass with queries

No known exploitation. EPSS puts it in the 75th percentile. A vendor fix is available.

CVSS 3.17.5High EPSS percentile75th1.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-04-07Updated 2026-08-04Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Vitejs ViteAffected: >= 8.0.0, < 8.0.5Upgrade to: not statedAffected: >= 7.1.0, < 7.3.2Upgrade to: not statedStated by: CVE record
Vitejs Vite-plusAffected: < 0.1.16Upgrade to: not statedStated by: CVE record
Voidzero Vite\+Affected: ≤ 0.1.15Upgrade to: after 0.1.15Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your business runs the Vite dev server (not just builds) and determine its version.
If the Vite dev server version is 7.1.0 to <7.3.2 or 8.0.5, plan an immediate upgrade (it is affected by this bypass).
Upgrade Vite to 7.3.2 or 8.0.5+ (fixed versions).
Ensure the dev server is not reachable from the public internet (restrict to localhost/VPN/internal network).
If the dev server was exposed while vulnerable, rotate any secrets that could have been in .env files (cloud keys, tokens, certificates) and review access logs for suspicious requests.

Vendor advisory Some work to apply

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

2 publishers

Exploitation reported in the wild
as reported · Sep 14, 2026·BleepingComputer summary
Proof-of-concept published
as reported · Jun 16, 2026·Daily CyberSecurity (securityonline.info)

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.

In plain language

Written by AI from the record

CVE-2026-39364 is a bypass in the Vite dev server that lets strangers pull sensitive files (like .env and certificates) even when file blocking is turned on; if your business runs a vulnerable Vite dev server publicly, you should treat this as urgent.

Unauthenticated file-read bypass in the Vite dev server where HTTP requests for files blocked by `server.fs.deny` can return file contents when specific query parameters (e.g., raw/import+raw/inline) are appended; attackers are actively scanning and targeting exposed Vite dev servers to steal credentials.

If you're affected

Environment secrets theft
Cloud credentials exposure
Certificate and key exposure
Account takeover risk

What is it

Vite’s development server has a safety setting meant to block access to sensitive files (like your .env file). This bug lets an attacker request those blocked files anyway by adding certain “query tricks” to the URL. In real attacks, scammers scan the internet for exposed dev servers and try to steal cloud credentials from files like .env.

Who is affected

This matters if your business runs the Vite development server and it is reachable over the network (especially from the internet). It specifically impacts Vite dev server versions between 7.1.0 and <7.3.2 and version 8.0.5, when server.fs.deny is in use. The risk is greatest when the vulnerable dev server is exposed and reachable from the network without an attacker needing a login.

How urgent is it

Attackers are actively scanning for exposed Vite development servers and using wordlists to pull secrets; exploitation has been reported. With a RED verdict, you should treat this as an urgent credential-theft risk if your Vite dev server is publicly reachable or otherwise reachable by untrusted networks.

What to do — in detail

Confirm exposure
- Identify where the Vite dev server is running (local dev only vs. deployed/hosted dev server).
- Determine the Vite version used by each affected service.
- Verify network reachability: is the dev server accessible from the public internet or any untrusted network?
Confirm likely exposure to this bug
- If you run Vite dev server version 7.1.0 to <7.3.2 or 8.0.5, assume you are affected.
- The bypass applies when protected files are requested while server.fs.deny is active, because query parameters can cause Vite to return the blocked file contents.
Upgrade to fixed versions
- Upgrade Vite to 7.3.2 (for the 7.x line) or to 8.0.5+ (for the 8.x line).
- Coordinate with your build/dev tooling so the team can keep working normally after the dependency update.
Immediate containment (if you can’t upgrade right away)
- Remove public exposure immediately by restricting access to the dev server to localhost, VPN, or your internal network only.
- Stop any currently exposed instances until the upgrade is complete.
If there’s any chance it was reachable while vulnerable
- Rotate credentials that may have been present in .env files (cloud provider keys/tokens, API keys, Terraform-related secrets).
- Review server/proxy logs for patterns consistent with secret hunting (requests targeting .env-like files and credential artifacts).
After patching
- Continue monitoring logs for follow-on scanning attempts.
- Ensure secrets are not unnecessarily stored in .env on machines/services that are internet-reachable.

Technical context

Severity is HIGH (CVSS 7.5) and the operational verdict is RED due to reported exploitation and sustained scanning activity. The weakness is a server.fs.deny bypass (CWE-180, plus related CWE-284 and CWE-472 themes), where the Vite dev server can be coerced into serving the contents of files that should be denied by adding specific query parameters to the request URL. The attacker does not need authentication or user interaction (network-accessible endpoint only).

Exploit maturity: exploitation reported in the wild; press reporting describes mass-scanning of exposed Vite dev servers, including use of wordlists targeting .env, AWS/Azure credential files, and Terraform-related files. KEV is not listed for this CVE, so detection depends on patching and exposure control. The vendor fix is available via the Vite security advisory (fixed in 7.3.2 and 8.0.5+).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS75th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.5% chance of exploitation activity in the next 30 days, which ranks it in the 75th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 119 days, from the signal feeds we watch.

2026-08-04Patch availablerecord updated
2026-07-24Patch availablerecord updated
2026-07-15Patch availablerecord updated
2026-06-30Patch availablerecord updated
2026-04-09Nuclei check added
2026-04-07Publishedweakness classified

Affected products

vitejsoss-projectaka vite, vite-plugin-react, vite-plus
- viteLibraryDevTools & CI / build-test-tools
- vite-plusLibraryDevTools & CI / build-test-tools
voidzerooss-projectaka vite+
- vite\+LibraryOSS Libraries / web-framework

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

Sources

References in the record

And 2 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Vite, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account