ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-112947

Vite is a frontend tooling framework for JavaScript.

Published Oct 20, 2026 · catalog updated Oct 21, 2026 · Vite is a frontend

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-112947. EPSS is 0.50%. Act only if a listed version of Vite is a frontend is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Vite is a frontend).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.50%
Remediation
Version ranges on file
Affected products
npm vite · npm vite-plus

### Summary The first 4 bytes of files outside of setting can be returned to the browser by a request containing . ### Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using or the [ ](https://vite.dev/config/server-options#server-host) option - there's a file that has a sensitive information in **the first 4 bytes** - uses Node.js or Deno to run Vite (if Bun is used, it is not affected) ### Details Requests containing the query are handled by the internal Wasm plugin's hook. The hook removes the query and reads the resulting path directly from disk, but the checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. ### PoC Create a denied file and start an affected Vite dev server: This will show

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm vite8.2.0 → 8.2.4
  • npm vite8.3.0 → 8.3.3
  • npm vite>= 8.2.0, <= 8.2.3
  • npm vite>= 8.3.0, <= 8.3.2
  • npm vite-plus0.2.8 → 1.1.0
  • npm vite-plus>= 0.2.8, <= 1.0.0

How to fix CVE-2026-112947

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-112947. EPSS is 0.50%. Act only if a listed version of Vite is a frontend is installed.

Which versions are affected?

Compare what you have installed with 8.2.0 → 8.2.4, 8.3.0 → 8.3.3, >= 8.2.0, <= 8.2.3, >= 8.3.0, <= 8.3.2, 0.2.8 → 1.1.0, >= 0.2.8, <= 1.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information; CWE-209; CWE-22: Path Traversal. EPSS 0.50%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 20, 2026 · NIST NVD

    Detected

    Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, bu

  2. Oct 20, 2026 · NIST NVD

    Updated

    Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, bu

  3. Oct 21, 2026 · NIST NVD

    Updated

    Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, bu

  4. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    vite fixed in 8.3.3; vite fixed in 8.2.4; vite-plus fixed in 1.1.0

  5. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    vite fixed in 8.3.3

  6. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    vite fixed in 8.2.4

  7. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    vite-plus fixed in 1.1.0

  8. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ### Summary The first 4 bytes of files outside of setting can be returned to the browser by a request containing . ### Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using or the [ ](https://vite.dev/config/server-options#server-host) option - there's a file that has a sensitive information in **the first 4 bytes** -

Sources

  • CVE.orgVulnerability recordCVE-2026-112947

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-112947

    30-day exploitation probability 0.50%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-vfpm-58rq-9qcg

    Vite: First 4 bytes of files outside of setting is exposed by

    github.com
  • NIST NVDVulnerability recordCVE-2026-112947

    Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-vfpm-58rq-9qcg

    Vite: First 4 bytes of files outside of setting is exposed by

    osv.dev

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 6, 2026
  • GitHub Advisory DatabaseOct 22, 2026
  • CVE.orgOct 21, 2026
  • OpenSSF OSV / OSV ScannerOct 21, 2026
  • NIST NVDOct 21, 2026