ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-112948

Vitest is a testing framework powered by Vite.

Published Oct 20, 2026 · catalog updated Oct 21, 2026 · Vitest is a testing

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-112948. EPSS is 0.40%. Act only if a listed version of Vitest is a testing is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Vitest is a testing).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.40%
Remediation
Version ranges on file
Affected products
npm @vitest/browser · npm @vitest/ui · npm vite-plus · package npm

### Summary In Vitest 5, Vite's is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as , private keys and certificates, , and ) or Vitest's own API token file ( ) can be read over plain HTTP by a client that can reach the server. In Browser Mode with , a malicious website can also read values through the developer's browser. This only applies when Vitest runs an HTTP server, which happens with the UI ( ), Browser Mode, or enabled. Plain and don't listen on any port and are not affected. The fix ships in , and and are listed because they are what enables the affected setups. Both pin to the same version as a peer dependency, so upgrading either one also requires the patched . Users who enable without or are also affected and should upgrade . ### Details Vitest 5 adds its API token file to , but neither server ended up with the intended list. That's because of two Vite behaviors. Vite applies its default deny list only when is unset, and it compiles the list into a matcher during config resolution, so later changes to the array have no effect. | setup | listening server | Vite's default deny list | | | ---------------------------------- | ------------------------------- | ------------------------ | ----------------------------------- | | plain / | none | not reachable | not reachable | | or | root | denied | **served** (fallback location only) | | Browser Mode, single project | root (also the browser server) | denied | **served** (fallback location only) | | Browser Mode with | each browser project's server | **served** | denied | - **Project servers** set from a hook, which replaces Vite's defaults. A project server listens on a port in Browser Mode with , so in that setup a request like returns the file. A plain is also served as , so a malicious page can include it with . A classic script include needs no CORS, and each dotenv line whose value is valid JavaScript (a quoted string, number, or

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @vitest/browser>= 5.0.0-beta.6, < 5.0.5
  • npm @vitest/ui>= 5.0.0-beta.6, < 5.0.5
  • npm vite-plus>= 1.0.0-rc.0, < 1.3.0
  • package npmversion unspecified

How to fix CVE-2026-112948

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-112948. EPSS is 0.40%. Act only if a listed version of Vitest is a testing is installed.

Which versions are affected?

Compare what you have installed with >= 5.0.0-beta.6, < 5.0.5, >= 1.0.0-rc.0, < 1.3.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information; CWE-552: Files or Directories Accessible to External Parties. EPSS 0.40%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 20, 2026 · NIST NVD

    Detected

    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vites

  2. Oct 20, 2026 · NIST NVD

    Updated

    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vites

  3. Oct 20, 2026 · NIST NVD

    Updated

    Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vites

  4. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ### Summary In Vitest 5, Vite's is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as , private keys and certificates, , and ) or Vitest's own API token file ( ) can be read over plain HTTP by a client that can reach the server. In Browser Mode with , a malicious website can also read values through the developer's browser

Sources

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 6, 2026
  • Snyk Vulnerability DatabaseOct 23, 2026
  • Snyk Vulnerability DatabaseOct 23, 2026
  • Snyk Vulnerability DatabaseOct 23, 2026
  • GitHub Advisory DatabaseOct 22, 2026
  • CVE.orgOct 21, 2026
  • NIST NVDOct 21, 2026