@vitest/browser
5.0.5 · 15 Oct 2026MIT7.9M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @vitest/browser. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 5.0.5 | No known advisory | |
| 4.1.12 | Safe from 4.1.10 | |
| 3.2.7 | Safe from 3.2.7 | |
| 2.1.9 | 18 open advisories, worst critical · last release Feb 2025, no longer updated |
- Critical@vitest/browser: Browser Mode provider commands bypass the file-access permission gateGHSA-p63j-vcc4-9vmv · 21 Jul 2026
- 4.x4.0.0 – 4.1.9Fixed in 4.1.10
- 3.x3.0.0 – 3.2.6Fixed in 3.2.7
- 2.x and older0.19.0 – 2.1.9No fix, no longer updated · move to 3.2.7
- CriticalVitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEGHSA-g8mr-85jm-7xhm · 15 Jun 2026
- 4.x4.0.0 – 4.1.7Fixed in 4.1.8
- 3.x3.0.0 – 3.2.4Fixed in 3.2.5
- CriticalVitest browser mode serves unsanitized otelCarrier query parameter as inline scriptGHSA-2h32-95rg-cppp · 1 Jun 2026
- 4.x4.0.17 – 4.1.5Fixed in 4.1.6
- ModerateVitest browser mode serves arbitrary filesGHSA-8gvc-j273-4wm5 · 4 Feb 2025
- 3.x3.0.0 – 3.0.3Fixed in 3.0.4
- 2.x2.0.4 – 2.1.8Fixed in 2.1.9
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.