vite

8.3.5 · 21 Oct 2026MIT119M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for vite. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	8.3.5	Safe from 8.3.3
	7.3.7	Safe from 7.3.7
	6.4.5	Safe from 6.4.4
	5.4.21	478 open advisories, worst high · last release Oct 2025, no longer updated

Your version

High
launch-editor: `fs.existsSync()` existence check can be bypassed on WindowsGHSA-587h-7wmj-h5pm · 20 Oct 2026
- 8.x8.0.0 – 8.3.2Fixed in 8.3.3
- 7.x7.0.0 – 7.3.6Fixed in 7.3.7
- 6.x6.0.0 – 6.4.3Fixed in 6.4.4
- 5.x and older0.1.0 – 5.4.21No fix, no longer updated · move to 6.4.4
High
vite: `server.fs.deny` bypass on Windows alternate pathsGHSA-fx2h-pf6j-xcff · 15 Jun 2026
- 8.x8.0.0 – 8.0.15Fixed in 8.0.16
- 7.x7.0.0 – 7.3.3Fixed in 7.3.5
- 6.x6.0.0 – 6.4.2Fixed in 6.4.3
- 5.x and older0.1.0 – 5.4.21No fix, no longer updated · move to 6.4.3
High
launch-editor vulnerable to command injection via the crafted request on WindowsGHSA-c27g-q93r-2cwf · 3 Jun 2026
- 5.x5.0.0 – 5.4.8Fixed in 5.4.9
- 4.x and older0.1.0 – 4.5.14No fix, no longer updated · move to 5.4.9
High
Vite: `server.fs.deny` bypassed with queriesGHSA-v2wj-q39q-566r · 6 Apr 2026
- 8.x8.0.0 – 8.0.4Fixed in 8.0.5
- 7.x7.1.0 – 7.3.1Fixed in 7.3.2
High
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocketGHSA-p9ff-h696-f583 · 6 Apr 2026
- 8.x8.0.0 – 8.0.4Fixed in 8.0.5
- 7.x7.0.0 – 7.3.1Fixed in 7.3.2
- 6.x6.0.0 – 6.4.1Fixed in 6.4.2
High
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystemGHSA-c24v-8rfc-w8vw · 19 Jan 2024
- 5.x5.0.0 – 5.0.11Fixed in 5.0.12
- 4.x4.0.0 – 4.5.1Fixed in 4.5.2
- 3.x3.0.0 – 3.2.7Fixed in 3.2.8
- 2.x2.7.0 – 2.9.16Fixed in 2.9.17
High
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)GHSA-353f-5xf4-qw67 · 6 Jun 2023
- 4.x4.0.0 – 4.3.8Fixed in 4.3.9
- 3.x3.0.2 – 3.2.6Fixed in 3.2.7
- 2.x2.0.0 – 2.9.15Fixed in 2.9.16
- 0.20.x and older0.1.0 – 0.20.10No fix, no longer updated · move to 2.9.16
High
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's serviceGHSA-mv48-hcvh-8jj8 · 19 Aug 2022
- 2.x2.0.0 – 2.9.12Fixed in 2.9.13
- 0.20.x and older0.1.0 – 0.20.10No fix, no longer updated · move to 2.9.13
Moderate
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineGHSA-rq7h-c2jc-7f22 · 21 Oct 2026
- 8.x8.0.0 – 8.3.2Fixed in 8.3.3
- 7.x7.0.0 – 7.3.6Fixed in 7.3.7
- 6.x6.0.0 – 6.4.3Fixed in 6.4.4
- 5.x and older0.1.0 – 5.4.21No fix, no longer updated · move to 6.4.4
Moderate
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`GHSA-vfpm-58rq-9qcg · 21 Oct 2026
- 8.x8.2.0 – 8.3.2Fixed in 8.3.3
Moderate
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsGHSA-r825-w8mm-5pxw · 20 Oct 2026
- 8.x8.0.0 – 8.3.2Fixed in 8.3.3
- 7.x7.0.0 – 7.3.6Fixed in 7.3.7
- 6.x6.0.0 – 6.4.3Fixed in 6.4.4
- 5.x and older0.1.0 – 5.4.21No fix, no longer updated · move to 6.4.4
Moderate
launch-editor: escapeCmdArgs() omits % escaping on WindowsGHSA-698v-4r3x-3vcv · 20 Oct 2026
- 8.x8.0.0 – 8.3.2Fixed in 8.3.3
- 7.x7.0.0 – 7.3.6Fixed in 7.3.7
- 6.x6.0.0 – 6.4.3Fixed in 6.4.4
- 5.x and older0.1.0 – 5.4.21No fix, no longer updated · move to 6.4.4
Moderate
launch-editor: NTLMv2 hash disclosure via UNC path handling on WindowsGHSA-v6wh-96g9-6wx3 · 15 Jun 2026
- 8.x8.0.0 – 8.0.15Fixed in 8.0.16
- 7.x7.0.0 – 7.3.3Fixed in 7.3.5
- 6.x6.0.0 – 6.4.2Fixed in 6.4.3
- 5.x and older0.1.0 – 5.4.21No fix, no longer updated · move to 6.4.3
Moderate
Vite Vulnerable to Path Traversal in Optimized Deps `.map` HandlingGHSA-4w7w-66w2-5vf9 · 6 Apr 2026
- 8.x8.0.0 – 8.0.4Fixed in 8.0.5
- 7.x7.0.0 – 7.3.1Fixed in 7.3.2
- 6.x6.0.0 – 6.4.1Fixed in 6.4.2
- 5.x and older0.1.0 – 5.4.21No fix, no longer updated · move to 6.4.2
Moderate
vite allows server.fs.deny bypass via backslash on WindowsGHSA-93m4-6634-74q7 · 20 Oct 2025
- 7.x7.0.0 – 7.1.10Fixed in 7.1.11
- 6.x6.0.0 – 6.4.0Fixed in 6.4.1
- 5.x5.0.0 – 5.4.20Fixed in 5.4.21
- 4.x and older2.9.18 – 4.5.14No fix, no longer updated · move to 5.4.21
Moderate
Vite's server.fs.deny bypassed with /. for files under project rootGHSA-859w-5945-r5v3 · 30 Apr 2025
- 6.x6.0.0 – 6.3.3Fixed in 6.3.4
- 5.x5.0.0 – 5.4.18Fixed in 5.4.19
- 4.x4.0.0 – 4.5.13Fixed in 4.5.14
- 3.x and older0.1.0 – 3.2.11No fix, no longer updated · move to 4.5.14
Moderate
Vite has an `server.fs.deny` bypass with an invalid `request-target`GHSA-356w-63v5-8wf4 · 11 Apr 2025
- 6.x6.0.0 – 6.2.5Fixed in 6.2.6
- 5.x5.0.0 – 5.4.17Fixed in 5.4.18
- 4.x4.0.0 – 4.5.12Fixed in 4.5.13
- 3.x and older0.1.0 – 3.2.11No fix, no longer updated · move to 4.5.13
Moderate
Vite allows server.fs.deny to be bypassed with .svg or relative pathsGHSA-xcj6-pq6g-qj4x · 4 Apr 2025
- 6.x6.0.0 – 6.2.4Fixed in 6.2.5
- 5.x5.0.0 – 5.4.16Fixed in 5.4.17
- 4.x4.0.0 – 4.5.11Fixed in 4.5.12
- 3.x and older0.1.0 – 3.2.11No fix, no longer updated · move to 4.5.12
Moderate
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryGHSA-4r4m-qw57-chr8 · 31 Mar 2025
- 6.x6.0.0 – 6.2.3Fixed in 6.2.4
- 5.x5.0.0 – 5.4.15Fixed in 5.4.16
- 4.x4.0.0 – 4.5.10Fixed in 4.5.11
- 3.x and older0.1.0 – 3.2.11No fix, no longer updated · move to 4.5.11
Moderate
Vite bypasses server.fs.deny when using ?raw??GHSA-x574-m823-4x7w · 25 Mar 2025
- 6.x6.0.0 – 6.2.2Fixed in 6.2.3
- 5.x5.0.0 – 5.4.14Fixed in 5.4.15
- 4.x4.0.0 – 4.5.9Fixed in 4.5.10
- 3.x and older0.1.0 – 3.2.11No fix, no longer updated · move to 4.5.10
Moderate
Websites were able to send any requests to the development server and read the response in viteGHSA-vg6x-rcgg-rjx6 · 21 Jan 2025
- 6.x6.0.0 – 6.0.8Fixed in 6.0.9
- 5.x5.0.0 – 5.4.11Fixed in 5.4.12
- 4.x4.0.0 – 4.5.5Fixed in 4.5.6
- 3.x and older0.1.0 – 3.2.11No fix, no longer updated · move to 4.5.6
Moderate
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSSGHSA-64vr-g452-qvp3 · 17 Sep 2024
- 5.x5.0.0 – 5.4.5Fixed in 5.4.6
- 4.x4.0.0 – 4.5.3Fixed in 4.5.5
- 3.x3.0.0 – 3.2.10Fixed in 3.2.11
- 2.x and older0.1.0 – 2.9.18No fix, no longer updated · move to 3.2.11
Moderate
Vite's `server.fs.deny` is bypassed when using `?import&raw`GHSA-9cwx-2883-4wfx · 17 Sep 2024
- 5.x5.0.0 – 5.4.5Fixed in 5.4.6
- 4.x4.0.0 – 4.5.3Fixed in 4.5.5
- 3.x3.0.0 – 3.2.10Fixed in 3.2.11
- 2.x and older0.1.0 – 2.9.18No fix, no longer updated · move to 3.2.11
Moderate
Vite's `server.fs.deny` did not deny requests for patterns with directories.GHSA-8jhw-289h-jh2g · 3 Apr 2024
- 5.x5.0.0 – 5.2.5Fixed in 5.2.6
- 4.x4.0.0 – 4.5.2Fixed in 4.5.3
- 3.x3.0.0 – 3.2.8Fixed in 3.2.10
- 2.x2.7.0 – 2.9.17Fixed in 2.9.18
Moderate
Vite XSS vulnerability in `server.transformIndexHtml` via URL payloadGHSA-92r3-m2mg-pj97 · 5 Dec 2023
- 5.x5.0.0 – 5.0.4Fixed in 5.0.5
- 4.x4.4.0 – 4.5.0Fixed in 4.5.1
Low
Vite: Cross origin script execution through Vite custom middlewareGHSA-9jrq-w75r-8gcw · 21 Oct 2026
- 8.x8.0.0 – 8.3.2Fixed in 8.3.3
- 7.x7.0.0 – 7.3.6Fixed in 7.3.7
- 6.x6.0.0 – 6.4.3Fixed in 6.4.4
- 5.x and older0.1.0 – 5.4.21No fix, no longer updated · move to 6.4.4
Low
Vite middleware may serve files starting with the same name with the public directoryGHSA-g4jq-h2w9-997c · 9 Sep 2025
- 7.x7.0.0 – 7.1.4Fixed in 7.1.5
- 6.x6.0.0 – 6.3.5Fixed in 6.3.6
- 5.x5.0.0 – 5.4.19Fixed in 5.4.20
- 4.x and older0.1.0 – 4.5.14No fix, no longer updated · move to 5.4.20
Low
Vite's `server.fs` settings were not applied to HTML filesGHSA-jqfw-vq24-v9c3 · 9 Sep 2025
- 7.x7.0.0 – 7.1.4Fixed in 7.1.5
- 6.x6.0.0 – 6.3.5Fixed in 6.3.6
- 5.x5.0.0 – 5.4.19Fixed in 5.4.20
- 4.x and older0.1.0 – 4.5.14No fix, no longer updated · move to 5.4.20

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Licence
MIT
Provenance
Present, built from github.com/vitejs/vite
Says where the release was built and from which commit. It does not say the code is safe.
Published by
GitHub Actions
Maintainers on npm
yyx990803, vitebot
Size
2.4 MB unpacked, 37 files
GitHub stars
83,345 on vitejs/vite
Last release
8.3.4, 8 October 2026
OpenSSF Scorecard
6.8 / 10 · 24 Aug 2026Lowest: CII-Best-Practices 0, Fuzzing 0, Binary-Artifacts 1
Grades the repository's practices (reviews, CI, branch protection), not the package's code.

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.