tocsin

CVE-2026-112946

2 advisories.

npm/vite CVE-2026-112946: medium 6.3

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Action: Upgrade vite to 6.4.4 or later.

npm i vite@8.3.3
npm i vite@8.2.4
npm i vite@8.1.6
npm i vite@7.3.7
npm i vite@6.4.4

Affected

introducedfixedlast affected
8.3.08.3.3-
8.2.08.2.4-
8.0.08.1.6-
7.0.07.3.7-
06.4.4-

Fixed versions

8.3.38.2.48.1.67.3.76.4.4

Sources

CVE-2026-112946 · published · modified · JSON

npm/vite-plus CVE-2026-112946: medium

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Action: Upgrade vite-plus to 1.1.0 or later.

npm i vite-plus@1.1.0

Affected

introducedfixedlast affected
01.1.0-

Fixed versions

1.1.0

Sources

CVE-2026-112946 · published · modified · JSON