CVE-2026-39364
1 advisory.
npm/vite CVE-2026-39364: high
Vite: `server.fs.deny` bypassed with queries
Action: Upgrade vite to 7.3.2 or later.
npm i vite@8.0.5npm i vite@7.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 8.0.5 | - |
| 7.1.0 | 7.3.2 | - |
Fixed versions
| 8.0.5 | 7.3.2 |
Sources
- osv: GHSA-v2wj-q39q-566r
- https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r
- https://nvd.nist.gov/vuln/detail/CVE-2026-39364
- https://github.com/vitejs/vite/pull/22160
- https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff
- https://github.com/vitejs/vite
- https://github.com/vitejs/vite/releases/tag/v7.3.2
- https://github.com/vitejs/vite/releases/tag/v8.0.5
CVE-2026-39364 · published · modified · JSON