CVE-2026-112947: Vite Package Exposes Sensitive File Data via ?vite-wasm-instance Query
Summary
CVE-2026-112947: Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance. Affects vite across 2 version ranges.
>= 8.2.0, < 8.2.4
>= 8.3.0, < 8.3.3
Fixed in 8.2.4 or 8.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vite is a modern build tool that provides a fast development environment for web applications. It leverages native ES modules and offers features like hot module replacement (HMR) for a seamless development experience. However, certain configurations can expose sensitive data, particularly when the server is accessible over the network.
Vulnerability Detail
The vulnerability arises from the handling of requests containing the '?vite-wasm-instance' query. When such a request is made, the internal Wasm plugin's load hook processes the request without applying necessary file system checks. This oversight allows the first four bytes of files outside the 'server.fs' setting to be returned to the browser, potentially exposing sensitive information if it resides in those bytes. The issue primarily affects applications that expose the Vite dev server to the network and have sensitive data in the first four bytes of specific files.
How To Fix
Latest published version: 8.3.5 as of 22 Oct 2026
npm install vite@8.3.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.2.0, < 8.2.48.2.4npm install vite@8.2.4 -
>= 8.3.0, < 8.3.38.3.3npm install vite@8.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid exposing the Vite dev server to the network by not using the '--host' option or by configuring 'server.host' to 'localhost'. Additionally, ensure that sensitive files are not placed in locations accessible by the Vite server.
Conclusion
The CVE-2026-112947 vulnerability in the Vite package can expose sensitive data through improperly handled requests. It is crucial to update to the latest patched versions and implement workarounds to mitigate risks until an update can be applied. Regular monitoring with tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for vite →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
Versions of Vite up to 8.3.2 and 8.2.3 are affected. Ensure to update to 8.3.3 or 8.2.4 or later.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you in real-time. You can also check your application using the Vulert playground without signup at Vulert Scanner.
If you cannot update immediately, ensure that your Vite server is not exposed to the network and avoid placing sensitive information in files that could be accessed through the server.
This vulnerability specifically affects Vite and vite-plus when they are configured to expose the server to the network. Other tools may have different vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for vite.
