CVE-2026-112945: Cross-origin script execution through Vite custom middleware
Summary
CVE-2026-112945: A malicious website can cause attacker-controlled JavaScript to execute in a Vite development page, potentially exposing sensitive values or enabling critical actions. Affects vite across 5 version ranges.
< 6.4.4
>= 7.0.0, < 7.3.7
>= 8.0.0, < 8.1.6
>= 8.2.0, < 8.2.4
>= 8.3.0, < 8.3.3
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vite is a JavaScript build tool and development server in the npm ecosystem. Developers use it to serve and transform application code during development. Its middleware mode also allows applications to embed Vite in a custom server, where the application can pass HTML through Vite's transformation process.
Vulnerability Detail
Cross-origin script execution can let a malicious website load attacker-controlled JavaScript in a page served by Vite's development server. The issue affects custom middleware setups that pass an unchanged browser request URL to server.transformIndexHtml and produce HTML containing an inline module script. The attacker can exploit URL handling in the HTML transformation to make the browser request a module from an attacker-controlled origin. Impact depends on whether the application exposes sensitive values or permits critical actions from that page.
How To Fix
Latest published version: 8.3.5 as of 22 Oct 2026
npm install vite@8.3.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.4.46.4.4npm install vite@6.4.4 -
>= 7.0.0, < 7.3.77.3.7npm install vite@7.3.7 -
>= 8.0.0, < 8.1.68.1.6npm install vite@8.1.6 -
>= 8.2.0, < 8.2.48.2.4npm install vite@8.2.4 -
>= 8.3.0, < 8.3.38.3.3npm install vite@8.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
AI-generated workaround (not vendor-documented): For Vite, avoid passing the browser's unchanged request URL to server.transformIndexHtml; use a trusted, normalized path and restrict access to the development server.
Documented mitigation:
const url = req.originalUrl
template = await vite.transformIndexHtml(url, template)
Conclusion
Upgrade Vite to 8.3.3 using the supplied command. The advisory lists separate fixed versions for other Vite release lines, so the appropriate fix depends on the installed line. Review custom middleware integrations that pass browser request URLs into HTML transformation and limit access to development servers. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for vite →
FAQ
Vite is affected through 8.3.2, 8.2.3, 8.1.5, 7.3.6, and 6.4.3; the advisory also lists vite-plus through 1.0.0.
CVE-2026-112945 can let a malicious website execute attacker-controlled JavaScript in a Vite development page, potentially exposing sensitive values or enabling critical actions.
Upgrade Vite to the minimum fixed version 8.3.3 using the supplied npm command.
For Vite, avoid passing unchanged browser request URLs to server.transformIndexHtml and restrict access to the development server.
Check package-lock.json for Vite and compare its version with the affected ranges. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for vite.
