CVE-2026-39364: Vite has a `server.fs.deny` bypass with queries
Summary
The contents of files that are specified by server.fs.deny can be returned to the browser.
Impact
Only apps that match the following conditions are affected:
- explicitly exposes the Vite dev server to the network (using --host or server.host config option) - the sensitive file exists in the allowed directories specified by server.fs.allow - the sensitive file is denied with a pattern that matches a file by server.fs.deny
Details
On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, .crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.
PoC
1. Start the dev server: pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort 2. Confirm that server.fs.deny is enforced (expect 403): curl -i http://127.0.0.1:5175/src/.env | head -n 20 <img width="3944" height="1092" alt="image" src="https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f" /> 3. Confirm that the same files can be retrieved with query parameters (expect 200): <img width="2014" height="373" alt="image" src="https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8" />
Other sources
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, .crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 7.3.2 - Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 8.0.5 - Upgrade
Upgrade
viteto a version that resolves this vulnerability.Fixed in 7.3.2 - Upgrade
Upgrade
viteto a version that resolves this vulnerability.Fixed in 8.0.5 - Configuration
Do not expose the Vite dev server to the network. Start it bound to loopback only (example from material): `pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort`.
Vite dev server server.host = 127.0.0.1 - Compensating control
If you must run an affected Vite version temporarily, ensure only trusted sources can reach the dev server (e.g., restrict inbound access to 127.0.0.1 / firewall or network ACL), since the vulnerability allows blocked files under `server.fs.deny` to be fetched over HTTP when query parameters like `?raw` or `?import&raw` are appended.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39364?
CVE-2026-39364 is considered to have a moderate severity level due to the potential for unauthorized file access.
How do I fix CVE-2026-39364?
To fix CVE-2026-39364, upgrade Vite to version 7.3.2 or 8.0.5 or later.
What versions of Vite are affected by CVE-2026-39364?
CVE-2026-39364 affects Vite versions between 7.1.0 and 7.3.1, and between 8.0.0 and 8.0.4.
What are the conditions that make an application vulnerable to CVE-2026-39364?
An application is vulnerable to CVE-2026-39364 if it explicitly uses the `server.fs.deny` configuration.
Is Vite-plus also affected by CVE-2026-39364?
Yes, Vite-plus versions up to and including 0.1.15 are affected by CVE-2026-39364.