Executive Summary
The Vite development server is affected by a vulnerability (CVE-2026-112947). The flaw allows an attacker to potentially disclose sensitive information (first 4 bytes of files) when the Vite dev server is exposed to the network or a file contains sensitive information in the first 4 bytes. This vulnerability can be exploited by sending a request with the vite-wasm-instance query string.
Technical Impact & Vector
The vulnerability occurs when requests containing the vite-wasm-instance query string are handled by the internal Wasm plugin’s load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. This allows an attacker to read the first 4 bytes of files outside of the server.fs setting, potentially disclosing sensitive information. The vulnerability is triggered when Vite attempts to parse the file as WebAssembly, which fails, resulting in an error message that contains the first 4 bytes of the file.
Remediation & Patch Instructions
To remediate this vulnerability, affected Vite users should:
* Ensure that the server.fs setting is applied to all files.
* Use a valid server.host option to restrict access to the Vite dev server.
* Upgrade to the latest version of Vite that includes a fix for this vulnerability. For Node.js users, this can be achieved by running npm install vite@latest. For Deno users, this can be achieved by running npm install vite@latest –save-exact. For users of other package managers, consult their documentation for instructions on upgrading Vite.
Note: The specific remediation steps may vary depending on the package manager and configuration used.
Official Reference: Read the full vulnerability breakdown and advisory details directly on the National Vulnerability Database (CVE-2026-112947).
Leave a Reply