npm/vite CVE-2026-39364: high 7.5, EPSS 2.26%
Vite: `server.fs.deny` bypassed with queries
Action: Upgrade vite to 7.3.2 or later.
npm i vite@8.0.5npm i vite@7.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 8.0.5 | - |
| 7.1.0 | 7.3.2 | - |
Fixed versions
| 8.0.5 | 7.3.2 |
Sources
- osv: GHSA-v2wj-q39q-566r
- nvd: CVE-2026-39364
- https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r
- https://github.com/vitejs/vite/pull/22160
- https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff
- https://github.com/vitejs/vite
- https://github.com/vitejs/vite/releases/tag/v7.3.2
- https://github.com/vitejs/vite/releases/tag/v8.0.5
CVE-2026-39364 · published · modified · JSON