vite
v8.3.8Next generation frontend tooling. It's fast!
- Maintenance
- Active308 commits in 3 months · bus factor 2
- License
- MITPermissive · OSI-approved
- Security
- 24 advisories1 critical, 6 high, 15 medium, 2 low · Scorecard 6.5/10
- Supported versions
- No scheduleendoflife.date does not track this project
83.9k stars · 10.2k forks · 802 open issues · last release 4 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 24 most recent advisories published by the maintainers: 1 critical, 6 high, 15 medium, 2 low. Check the patched version against the one you run.
- criticalGHSA-p4f5-76q4-ffq7Nov 10, 2026Remote code execution using `__vite-browser-external` virtual module
- Affected
- >=8.3.0,<=8.3.6; >=8.2.0,<=8.2.4; >=8.0.0,<=8.1.6; >=7.0.0,<=7.3.7; >= 4.0.0,<=6.4.5; <=1.5.0
- Patched in
- 8.3.7; 8.2.5; 8.1.7; 7.3.8; 6.4.6; 1.5.1
- mediumCVE-2026-118662Oct 21, 2026`server.fs.deny` bypassed with queries for v6
- Affected
- 6.4.4
- Patched in
- 6.4.5
- lowCVE-2026-112945Oct 6, 2026Cross origin script execution through Vite custom middleware
- Affected
- >=8.3.0,<=8.3.2; >=8.2.0,<=8.2.3; >=8.0.0,<=8.1.5; >=7.0.0,<=7.3.6; <=6.4.3; <=1.0.0
- Patched in
- 8.3.3; 8.2.4; 8.1.6; 7.3.7; 6.4.4; 1.1.0
- mediumCVE-2026-112947Oct 6, 2026First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
- Affected
- >=8.3.0,<=8.3.2; >= 8.2.0, <= 8.2.3; >=0.2.8, <=1.0.0
- Patched in
- 8.3.3; 8.2.4; 1.1.0
- mediumCVE-2026-112946Oct 6, 2026Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
- Affected
- >=8.3.0,<=8.3.2; >=8.2.0,<=8.2.3; >=8.0.0,<=8.1.5; >=7.0.0,<=7.3.6; <=6.4.3; <=1.0.0
- Patched in
- 8.3.3; 8.2.4; 8.1.6; 7.3.7; 6.4.4; 1.1.0
- mediumCVE-2026-53571Jun 1, 2026`server.fs.deny` bypass on Windows alternate paths
- Affected
- >=8.0.0,<=8.0.15; >=7.0.0,<=7.3.4; <=6.4.2; <=0.1.23
- Patched in
- 8.0.16; 7.3.5; 6.4.3; 0.1.24
- mediumCVE-2026-39365Apr 6, 2026Path Traversal in Optimized Deps `.map` Handling
- Affected
- >=8.0.0,<=8.0.4; >=7.0.0,<=7.3.1; <=6.4.1; <=0.1.15
- Patched in
- 8.0.5; 7.3.2; 6.4.2; 0.1.16
- mediumCVE-2026-39364Apr 6, 2026`server.fs.deny` bypassed with queries
- Affected
- >=8.0.0,<=8.0.4; >=7.1.0,<=7.3.1; <=0.1.15
- Patched in
- 8.0.5; 7.3.2; 0.1.16
- highCVE-2026-39363Apr 6, 2026Arbitrary File Read via Vite Dev Server WebSocket
- Affected
- >=8.0.0,<=8.0.4; >=7.0.0,<=7.3.1; >=6.0.0,<=6.4.1; <=0.1.15
- Patched in
- 8.0.5; 7.3.2; 6.4.2; 0.1.16
- mediumCVE-2025-62522Oct 20, 2025`server.fs.deny` bypassed with `\` on Windows
- Affected
- >=7.1.0,<=7.1.10; >=7.0.0,<=7.0.7; >=6.0.0,<=6.4.0; >=2.9.18,<3.0.0,>=3.2.9,<4.0.0,>=4.5.3,<5.0.0,>=5.2.6,<=5.4.20
- Patched in
- 7.1.11; 7.0.8; 6.4.1; 5.4.21
- mediumCVE-2025-58751Sep 8, 2025Files starting with the same name with the public directory were served
- Affected
- >=7.1.0,<=7.1.4; >=7.0.0,<=7.0.6; >=6.0.0,<=6.3.5; <=5.4.19
- Patched in
- 7.1.5; 7.0.7; 6.3.6; 5.4.20
- mediumCVE-2025-58752Sep 8, 2025`server.fs` settings was not applied to HTML files
- Affected
- >=7.1.0,<=7.1.4; >=7.0.0,<=7.0.6; >=6.0.0,<=6.3.5; <=5.4.19
- Patched in
- 7.1.5; 7.0.7; 6.3.6; 5.4.20
- mediumCVE-2025-46565Apr 30, 2025`server.fs.deny` bypassed with `/.` for files under project `root`
- Affected
- >=6.3.0, <=6.3.3; >=6.2.0, <=6.2.6; >=6.0.0, <=6.1.5; >=5.0.0, <=5.4.18; <=4.5.13
- Patched in
- >=6.3.4; >=6.2.7, <6.3.0; >=6.1.6, <6.2.0; >=5.4.19, <6.0.0; >=4.5.14, <5.0.0
- highCVE-2025-32395Apr 10, 2025`server.fs.deny` bypassed with an invalid `request-target`
- Affected
- >=6.2.0, <=6.2.5; >=6.1.0, <=6.1.4; >=6.0.0, <=6.0.14; >=5.0.0, <=5.4.17; <=4.5.12
- Patched in
- >=6.2.6; >=6.1.5, <6.2.0; >=6.0.15, <6.1.0; >=5.4.18, <6.0.0; >=4.5.13, <5.0.0
- highCVE-2025-31486Apr 3, 2025`server.fs.deny` bypassed with `.svg` or relative paths
- Affected
- >=6.2.0, <=6.2.4; >=6.1.0, <=6.1.3; >=6.0.0, <=6.0.13; >=5.0.0, <=5.4.16; <=4.5.11
- Patched in
- >=6.2.5; >=6.1.4, <6.2.0; >=6.0.14, <6.1.0; >=5.4.17, <6.0.0; >=4.5.12, <5.0.0
- highCVE-2025-31125Mar 31, 2025`server.fs.deny` bypassed for `inline` and `raw` with `?import` query
- Affected
- >=6.2.0, <=6.2.3; >=6.1.0, <=6.1.2; >=6.0.0, <=6.0.12; >=5.0.0, <=5.4.15; <=4.5.10
- Patched in
- >=6.2.4; >=6.1.3, <6.2.0; >=6.0.13, <6.1.0; >=5.4.16, <6.0.0; >=4.5.11, <5.0.0
- highCVE-2025-30208Mar 24, 2025server.fs.deny bypassed when using `?raw??`
- Affected
- >=6.2.0, <=6.2.2; >=6.1.0, <=6.1.1; >=6.0.0, <=6.0.11; >=5.0.0, <=5.4.14; <=4.5.9
- Patched in
- >=6.2.3; >=6.1.2, <6.2.0; >=6.0.12, <6.1.0; >=5.4.15, <6.0.0; >=4.5.10, <5.0.0
- mediumCVE-2025-24010Jan 20, 2025Any websites were able to send any requests to the development server and read the response
- Affected
- >=6.0.0, <=6.0.8; >=5.0.0, <=5.4.11; <=4.5.5
- Patched in
- >=6.0.9; >=5.4.12, <6.0.0; >=4.5.6, <5.0.0
- mediumCVE-2024-45812Sep 17, 2024DOM Clobbering gadget found in vite bundled scripts that leads to XSS
- Affected
- >=5.4.0, <=5.4.5; >=5.3.0, <=5.3.5; >=5.1.0, <=5.2.13; >=5.0.0, <=5.1.7; >=4.0.0, <=4.5.3; <=3.2.10
- Patched in
- >=5.4.6; >=5.3.6, <5.4.0; >=5.2.14, <5.3.0; >=5.1.8, <5.2.0; >=4.5.5, <5.0.0; >=3.2.11, <4.0.0
- highCVE-2024-45811Sep 17, 2024server.fs.deny bypassed when using ?import&raw
- Affected
- >=5.4.0, <=5.4.5; >=5.3.0, <=5.3.5; >=5.0.0, <=5.2.13; >=5.0.0, <=5.1.7; >=4.0.0, <=4.5.3; <=3.2.10
- Patched in
- >=5.4.6; >=5.3.6, <5.4.0; >=5.2.14, <5.3.0; >=5.1.8, <5.2.0; >=4.5.5, <5.0.0; >=3.2.11, <4.0.0
- mediumCVE-2024-31207Apr 3, 2024`server.fs.deny` did not deny requests for patterns with directories.
- Affected
- >=2.7.0, <= 2.9.17; >=3.0.0, <=3.2.8; >=4.0.0, <=4.5.2; >=5.0.0, <=5.0.12; >=5.1.0, <=5.1.6; >=5.2.0, <=5.2.5
- Patched in
- 2.9.18; 3.2.10; 4.5.3; 5.0.13; 5.1.7; 5.2.6
- mediumCVE-2024-23331Jan 19, 2024Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
- Affected
- >=2.7.0 <=2.9.16; >=3.0.0 <=3.2.7; >=4.0.0 <=4.5.1; >=5.0.0 <=5.0.11
- Patched in
- >=2.9.17 <3.0.0; >=3.2.8 <4.0.0; >=4.5.2 <5.0.0; >=5.0.12
- lowCVE-2023-49293Dec 4, 2023XSS vulnerability in `server.transformIndexHtml` via URL payload
- Affected
- >=4.4.0 <=4.4.11; 4.5.0; >=5.0.0 <=5.0.4
- Patched in
- >=4.4.12 <4.5.0; >=4.5.1 <5.0.0; >=5.0.5
- mediumCVE-2023-34092Jun 1, 2023Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
- Affected
- 2.9.15; >=3.0.2 <=3.2.6; >=4.0.0 <=4.0.4; >=4.1.0 <=4.1.4; >=4.2.0 <=4.2.2; >=4.3.0 <=4.3.8
- Patched in
- >=2.9.16 <3.0.0; >=3.2.7 <4.0.0; >=4.0.5 <4.1.0; >=4.1.5 <4.2.0; >=4.2.3 <4.3.0; >=4.3.9