CVE-2026-118662 vitejs CVE debrief

Who should care

Defenders responsible for Vite applications, especially those exposing the dev server to the network, should assess their configurations and update to mitigate this vulnerability. This includes reviewing Vite configurations for `server.fs.deny` and `server.fs.allow` settings, and ensuring that sensitive files are not inadvertently exposed. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and

Why it matters

This vulnerability in Vite allows sensitive files to be accessed despite being denied by `server.fs.deny` configurations, posing a risk to applications exposing the dev server to the network.

• Potential exposure of sensitive files
• Bypass of security settings through query parameters
• Risk of unauthorized data access
• Need for configuration review and update

Technical summary

The Vite dev server is vulnerable to a bypass of the `server.fs.deny` setting when certain query parameters are appended to file requests. This allows sensitive files to be retrieved, potentially exposing confidential data. The vulnerability affects applications that expose the Vite dev server to the network, have sensitive files in allowed directories, and use `server.fs.deny` patterns that match those files. Defenders should prioritize verifying their Vite configurations and update to version 6.4.5 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying their Vite configurations, especially for applications exposing the dev server to the network, and update to version 6.4.5 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify Vite configurations for `server.fs.deny` and `server.fs.allow` settings
• Update to Vite version 6.4.5 or later
• Review application configurations for exposed dev servers
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The evidence for this vulnerability comes from the OSV Dev source item and the CVE Program record. The issue is related to the Vite dev server's handling of file requests and query parameters. Defenders should verify their Vite configurations, especially for applications exposing the dev server to the network, and update to version 6.4.5 or later to mitigate this vulnerability. Evidence is limited, and further verification is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.