Two High-Severity CVEs Patched in Vite: Dev Server WebSocket File Read and fs.deny Bypass
Vite patches CVE-2026-39363 (arbitrary file read via dev server WebSocket) and CVE-2026-39364 (server.fs.deny bypass), affecting versions 6.x, 7.x, and 8.x. Fixed in 6.4.2, 7.3.2, and 8.0.5.
Send crafted vite:invoke events with file:// URIs and ?raw or ?inline query parameters over a dev server's WebSocket, and you can read arbitrary files off the host machine: that's CVE-2026-39363 (CVSS 7.5, CVSS 4.0 8.2), one of two high-severity vulnerabilities Vite patched this week across the 6.x, 7.x, and 8.x release lines. The attack bypasses server.fs.allow restrictions entirely through the WebSocket path, requiring no authentication.
CVE-2026-39364 (CVSS 7.5, CVSS 4.0 8.2) bypasses server.fs.deny when query parameters like ?raw, ?import&raw, or ?import&url&inline hit restricted files such as .env and *.crt certificates. CVE-2026-39363 affects 6.0.0 through 6.4.1, 7.0.0 through 7.3.1, and 8.0.0 through 8.0.4; CVE-2026-39364 affects 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 (the 6.x line is unaffected). Patches ship in 6.4.2, 7.3.2, and 8.0.5.
Both vulnerabilities require the dev server to be network-accessible, but don't count on that for protection: Vite's dev WebSocket has no Origin header check by default, so any client that reaches the port can fire malicious messages. If you expose Vite dev servers via --host for mobile testing or run them in shared Docker environments, upgrade now. These CVEs only affect the dev server, not production builds.