cyfenced.com →

[ CVE-2026-118662 · Published 28 Oct 2026 ]

Vite: `server.fs.deny` bypassed with queries

CVSS 6.9 EPSS <1%Fix available

[ Description ]Official description

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.

[ Fixes ]Fixes and patches

  • vite 6.4.5Fixed version · GitHub Advisories · npm package vite: upgrade to 6.4.5 or later (affected = 6.4.4)

[ Packages ]Affected open-source packages

[ References ]References