CVE-2026-112947

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...

CVE-2026-112947

The Vite frontend tooling framework (versions 8.2.0 through 8.2.4 and 8.3.3 ) is vulnerable to a path traversal and information exposure flaw. An attacker can request files outside the server.fs setting by using the ?vite-wasm-instance query parameter. The internal Wasm plugin's load hook handles...

CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...