CVE-2026-112945 vitejs CVE debrief

Who should care

Defenders responsible for Vite configurations, especially those using middleware mode or custom app types, should assess their exposure and verify their configurations to prevent exploitation.

Why it matters

Defenders should prioritize verifying their Vite configurations, especially those using middleware mode or custom app types, and ensure they are using a version of Vite that addresses this issue to prevent cross-origin script execution.

• Verify Vite configurations to prevent cross-origin script execution
• Update affected applications to a version of Vite that addresses this issue
• Review and adjust middleware mode or custom app type configurations

Technical summary

The vulnerability exists in Vite when using custom middleware. An attacker can load scripts from a page served by the dev server by accessing a malicious site while the dev server is running. This issue affects applications that use Vite in middleware mode, read trusted HTML, and pass the browser's unchanged request URL to the transform. Defenders should prioritize verifying their Vite configurations, especially those using middleware mode or custom app types, and ensure they are using a version of Vite that addresses this issue to prevent cross-origin script execution.

Defensive priority

Defenders should prioritize verifying their Vite configurations, especially those using middleware mode or custom app types, and ensure they are using a version of Vite that addresses this issue.

Recommended defensive actions

• Verify Vite configurations, especially those using middleware mode or custom app types
• Ensure usage of a version of Vite that addresses this issue
• Review and update affected applications to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability details are based on the provided source item from osv_dev and references from the Vite project. The affected configurations and versions are documented in the source item and related references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.