NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

Vite: `server.fs.deny` bypassed with queriesGHSA-v2wj-q39q-566r

Fix: vitejs/vite#22160

GHSA-v2wj-q39q-566r is a CWE-180 vulnerability in vite. A fix is available for vite — see the affected versions and patch details below.

Also known asCVE-2026-39364
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for GHSA-v2wj-q39q-566r.

EPSS Exploitation Probability

via FIRST.org ↗
2.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs83th percentile — riskier than 83% of all scored CVEsHighest risk
0.00%2.81%5.61%8.42%3.6%2.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

7Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
vitenpm
250.3Mdownloads / week

Description

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

Details

On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.

PoC

  1. Start the dev server: pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort
  2. Confirm that server.fs.deny is enforced (expect 403): curl -i http://127.0.0.1:5175/src/.env | head -n 20 <img width="3944" height="1092" alt="image" src="https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f" />
  3. Confirm that the same files can be retrieved with query parameters (expect 200): <img width="2014" height="373" alt="image" src="https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8" />

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmvite≥ 8.0.0&&< 8.0.58.0.5npm install vite@8.0.5
📦npmvite≥ 7.1.0&&< 7.3.27.3.2npm install vite@7.3.2

Affected Products

2 products · 3 configurations
Application
vitevitejs
≥ 8.0.0 && ≤ 8.0.4
range
Application
vite\+voidzero
≤ 0.1.15
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for vite, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update vite to 8.0.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v2wj-q39q-566r is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

How to detect GHSA-v2wj-q39q-566r

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id ghsa-v2wj-q39q-566r -u https://target
Template
Vite Dev Server - Directory Traversal
Severity
high
Impact
Attackers can retrieve sensitive files like .env or certificates, leading to information disclosure.
Remediation
Update to versions 7.3.2 or 8.0.5 or later.

Template by ProjectDiscovery nuclei-templates (ritikchaddha), MIT licensed. View the full template. Scan only systems you are authorised to test.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant
Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Source: Red Hat security advisory for GHSA-v2wj-q39q-566r (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Ansible Automation Platform 2.6ansible-automation-platform-tech-preview/mcp-server-rhel9:1779783248RHSA-2026:24866

Frequently Asked Questions

### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser. ### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow) - the sensitive file is denied with a pattern that mat
O3 Security · Impact-Aware SCA

Is GHSA-v2wj-q39q-566r in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Vite: `server.fs.deny` bypassed with queries