CVE-2026-39364 Public exploit High · 8.2 EPSS 2.3%

Vite has a `server.fs.deny` bypass with queries

vitejs · vite

Official description · CVE.org

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.

Breakdown

75.3 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 5 months after disclosure.

Disclosed7 Apr 2026day 0
First seen exploitedVulnCheck KEV evidence11 Sep 2026+5 mo

See the family tree

9 related vulnerabilities in the same code over 19 months. The latest fix listed for vite is 8.0.16.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2024-45811server.fs.deny bypassed when using ?import&raw in vite17 Sep 2024
relatedMedium
Why these are linked:
- Same code patched: transform.ts, index.html (machine-matched)Functions: transformMiddlewarecommit 6820bb3 commit 4573a6f commit 315695e commit 80381c3
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
CVE-2025-30208Vite bypasses server.fs.deny when using `?raw??`24 Mar 2025
relatedHigh
Why these are linked:
- Fixed one release later6.2.3 → 6.2.4 (vite)
- Fixed one release later4.5.10 → 4.5.11 (vite)
- Same code patched: transform.ts, index.html (machine-matched)Functions: transformMiddlewarecommit 315695e commit 80381c3 commit 5967313
- Similar weakness in the same product (machine-matched)same package + description similarity
CVE-2025-31125Vite Vitejs Improper Access Control31 Mar 2025KEV
relatedMedium
Why these are linked:
- Same code patched: transform.ts, index.html (machine-matched)Functions: transformMiddlewarecommit 5967313 commit a9a3df2
This CVECVE-2026-39364Vite has a `server.fs.deny` bypass with queries7 Apr 2026
relatedMedium
Why these are linked:
- Same code patched: transform.ts (machine-matched)Functions: transformMiddlewarecommit a9a3df2 commit 79f002f
CVE-2026-39365Vite has a Path Traversal in Optimized Deps `.map` Handling7 Apr 2026

4 more CVEs are in this family. See the family tree

Fixes in vitenpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

7.1.5CVE-2025-587528 Sep 2025
7.1.11CVE-2025-6252220 Oct 2025
8.0.5CVE-2026-393637 Apr 2026
8.0.5CVE-2026-393647 Apr 2026
8.0.5CVE-2026-393657 Apr 2026
8.0.16CVE-2026-5357122 Jun 2026
8.0.16CVE-2026-5363222 Jun 2026Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: vite.

npmviteGHSA-v2wj-q39q-566r

Upgrade to 8.0.5 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2026-39365).

npmnpm install vite@8.0.5

The first fix for CVE-2026-39364.

Affected versions, by release line

If you run	Upgrade to
8.0.0 up to 8.0.5	8.0.5
7.1.0 up to 7.3.2	7.3.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 21 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Exposed Vite Development Servers Targeted for AWS and Azure Credential Theft17 Sep 2026
Vite CVE-2026-39364 Mass Scan: Cloud Credential & IaC Theft from Exposed Dev Servers16 Sep 2026
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers15 Sep 2026
Vite CVE-2026-39364 Mass Scanning for AWS/Azure Secrets15 Sep 2026
Hackers target exposed Vite dev servers to steal AWS, Azure secrets14 Sep 2026
Known_Cve | Apr 24, 2026 | Part 1/223 Apr 2026
15 more on OTX

References

5 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2026-19873

Public exploitAdvisories link exploit code.

, 30 Oct 2026

2.3%Top 17%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 82.9%).

4.0

8.2High · 8.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 50 days ago 10.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.8295 16.6/20

Threat reports0 reports 0.0/10

Public exploit code1 nuclei template 5.0/5

Mentioned in OTX pulses21 pulses 3.0/3

CVSS base scorebase score 8.2 5.7/7

End-of-life productsupported or unknown 0.0

Total75.3

Record

Published: 7 Apr 2026
Modified: 17 Aug 2026
: CWE-180 Incorrect Behavior Order: Validate Before CanonicalizeCWE-284 Improper Access ControlCWE-472 External Control of Assumed-Immutable Web Parameter
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in vitenpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 21 community threat pulses (AlienVault OTX)

References

x_refsource_CONFIRM 1

vdb-entry 1

issue-tracking 1

x_sadp-csaf-vex 1

vendor-advisory 1

techniques