CVE-2026-118662

About vulnerability

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.

Affected product:

@vinxi/devtools , Next.js , React , TanStack/router , Vue , allure-js , analogjs-astro-angular , analogjs-platform , analogjs-storybook-angular , analogjs-vite-plugin-angular , analogjs-vite-plugin-nitro , analogjs-vitest-angular , angular-build , angular-devkit-build-angular , antfu-design , appkit , arcjet-js , assistant-ui-vite , astro , astro-expressive-code , astrojs-cloudflare , astrojs-markdoc , astrojs-markdown-remark , astrojs-mdx , astrojs-netlify , astrojs-node , astrojs-preact , astrojs-react , astrojs-solid-js , astrojs-starlight , astrojs-svelte , astrojs-tailwind , astrojs-vercel , astrojs-vue , better-auth , better-auth-test-utils , builder.io-qwik-city , bundle-stats , chat-adapter-tests , chromatic-e2e , clerk-astro , client , cloudflare-vitest-plugin , create-sanity , cypress , devframe , devframes-hub , devframes-plugin-assets , devframes-plugin-code-server , devframes-plugin-data-inspector , devframes-plugin-messages , devframes-plugin-og , devframes-plugin-terminals , devframes-vite , devtools , dxup-nuxt , effect-doctest , effect-vitest , elements , embroider-vite , fumadocs , fumadocs-ai-chat , fumadocs-graphql , fumadocs-sanity , fumadocs-ui , fumapress , fumapress-ai , fumapress-feedback , fumapress-graphql , fumapress-mintlify , get-it , graphql-codegen-testing , imagetools , import , impound , inertiajs-vite , inspect , joshwooding-vite-plugin-react-docgen-typescript , kit , leafygreen-ui , lg-tools-storybook-addon , lg-tools-storybook-decorators , lingui-vite-plugin , livestore , livestore-adapter-cloudflare , livestore-adapter-web , livestore-common , livestore-common-cf , livestore-framework-toolkit , livestore-livestore , livestore-react , livestore-sqlite-wasm , livestore-sync-cf , livestore-sync-electric , livestore-utils , livestore-utils-dev , livestore-webmesh , logs-sdk , logtape-testing-vitest , lucide-astro , mastra-server-adapters-test-suite , module-federation/vite , my-bad , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , nitro , nostics , nuxt , nuxt-cli , nuxt-devtools , nuxt-devtools-kit , nuxt-devtools-ui-kit , nuxt-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-test-utils , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , nuxt/test-utils , nx-angular-rspack , nx-angular-rspack-compiler , nx-detox , nx-expo , nx-module-federation , nx-next , nx-react , nx-react-native , nx-vite , nx-vitest , nx-vue , nx-web , octane , octanejs-app-core , octanejs-astro , octanejs-email , octanejs-email-cli , octanejs-livestore , octanejs-vite-plugin , orama-orama , oxc , oxc-unshadowed-visitor , oxfmt , oxlint , oxlint-config-inspector , panda , pandacss-transformer , pandacss-vite , pigment-css , pkg-utils , playwright , playwright-experimental-ct-core , playwright-experimental-ct-react , powersync-js , powersync-nuxt , preact-preset-vite , prefresh , qwik , racejar , remix , ripple , rollup-plugin-stats , rollup-plugin-webpack-stats , runtime-cli , sanity , sanity-blueprints , sanity-cli , sanity-cli-build , sanity-cli-test , sanity-codegen , sanity-io/cli , sanity-migrate , sanity-plugin-mux-input , sanity-preview-url-secret , sanity-svelte-loader , sanity-tsdown-config , sanity-vanilla-extract-vite-plugin , sanity-vercel-protection-bypass , sanity-vision , sanity-workbench-cli , scalar-astro , scalar-starlight , scalar-sveltekit , sentry-astro , sentry-cloudflare , sentry-nitro , sentry-nuxt , sentry-solidstart , sentry-sveltekit , solid-vite-plugin , solidjs-start , storybook , storybook-addon-a11y , storybook-angular , storybook-angular-vite , storybook-builder-vite , storybook-builder-webpack5 , storybook-core-webpack , storybook-csf-plugin , storybook-experimental-nextjs-vite , storybook-html , storybook-html-vite , storybook-nextjs-vite , storybook-preact , storybook-preact-vite , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-svelte , storybook-svelte-vite , storybook-sveltekit , storybook-tanstack-react , storybook-vue3 , storybook-vue3-vite , storybook-web-components , storybook-web-components-vite , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-strapi , stryker-mutator-vitest-runner , sveltejs-adapter-bun , sveltejs-adapter-node , sveltejs-adapter-static , sveltejs-adapter-vercel , sveltejs-kit , sveltejs-vite-plugin-svelte-inspector , tabler-icons-astro , tailwindcss-vite , tanstack-devtools-vite , tanstack-directive-functions-plugin , tanstack-react-start , tanstack-react-start-rsc , tanstack-router-plugin , tanstack-start-plugin-core , tanstack-table , telemetry , test-utils , tsrx-vite-plugin-hono , tsrx-vite-plugin-preact , tsrx-vite-plugin-react , tsrx-vite-plugin-solid , tsrx-vite-plugin-vue , tsrx-vue , unctx , unhead , unhead-bundler , unhead-vue , unimport , unocss , unocss-astro , unocss-inspector , unocss-nuxt , unocss-vite , unocss-webpack , unplugin , unplugin-combine , unplugin-vue , vanilla-extract , vercel , vercel-react-router , vercel-remix-builder , vinxi , vinxi-router , vinxi-server-components , vinxi-server-functions , visual-editing , vite , vite-dev-rpc , vite-hot-client , vite-node , vite-plugin-babel , vite-plugin-basic-ssl , vite-plugin-checker , vite-plugin-css-injected-by-js , vite-plugin-inspect , vite-plugin-istanbul , vite-plugin-react , vite-plugin-rnw , vite-plugin-ruby , vite-plugin-satteri , vite-plugin-singlefile , vite-plugin-solid , vite-plugin-storybook-nextjs , vite-plugin-svelte , vite-plugin-tanstack-start-zephyr , vite-plugin-top-level-await , vite-plugin-vinext-zephyr , vite-plugin-vue , vite-plugin-vue-inspector , vite-plugin-vue-tracer , vite-plugin-vuetify , vite-plugin-zephyr , vite-plus , vite-prerender-plugin , vite-tsconfig-paths , vitefu , vitejs-devtools , vitejs-devtools-kit , vitejs-devtools-vitest , vitejs-plugin-react , vitejs-plugin-react-swc , vitepress , vitest , vitest-axe , vitest-browser , vitest-browser-playwright , vitest-browser-preview , vitest-coverage-istanbul , vitest-coverage-v8 , vitest-mocker , vitest-ui , vitest-web-worker , vitest-webdriverio , voidzero-dev-vite-plus-test , waku , wdio-browser-runner , wdio-devtools-script , web3auth-web , workers-sdk , workflow-vitest , workflow-world-testing , workflows , wyw-in-js-vite , zbsearch-plugin-starlight , zbsearch-plugin-vitepress , zephyr-astro-integration , zephyr-nuxt-module

Affected packages:

vite @ 6.4.4 (+3118 more)