Medium severity5.3NVD Advisory· Published Apr 7, 2026· Updated Apr 30, 2026
CVE-2026-39365
CVE-2026-39365
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vitenpm | >= 8.0.0, < 8.0.5 | 8.0.5 |
vitenpm | >= 7.0.0, < 7.3.2 | 7.3.2 |
vitenpm | < 6.4.2 | 6.4.2 |
Affected products
14- osv-coords12 versionspkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/vitepkg:apk/chainguard/vitess-22pkg:apk/chainguard/vitess-23pkg:apk/wolfi/langfuse-3-workerpkg:apk/wolfi/vitepkg:apk/wolfi/vitess-22pkg:apk/wolfi/vitess-23pkg:npm/vite
< 2.95.12-r19+ 11 more
- (no CPE)range: < 2.95.12-r19
- (no CPE)range: < 3.164.0-r5
- (no CPE)range: < 2.95.12-r22
- (no CPE)range: < 3.164.0-r3
- (no CPE)range: < 8.0.11-r0
- (no CPE)range: < 22.0.4-r9
- (no CPE)range: < 23.0.3-r11
- (no CPE)range: < 3.164.0-r5
- (no CPE)range: < 8.0.11-r0
- (no CPE)range: < 22.0.4-r9
- (no CPE)range: < 23.0.3-r11
- (no CPE)range: >= 8.0.0, < 8.0.5
Patches
Vulnerability mechanics
References
8- github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-4w7w-66w2-5vf9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-39365ghsaADVISORY
- github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694ghsaWEB
- github.com/vitejs/vite/pull/22161ghsaWEB
- github.com/vitejs/vite/releases/tag/v6.4.2ghsaWEB
- github.com/vitejs/vite/releases/tag/v7.3.2ghsaWEB
- github.com/vitejs/vite/releases/tag/v8.0.5ghsaWEB
News mentions
0No linked articles in our index yet.