CVE-2026-39364

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...

CVE-2026-39364

The frontend tooling framework Vite is vulnerable to an access control bypass in the development server. Specifically, files intended to be blocked by the server.fs.deny configuration (such as .env or *.crt) can be retrieved with HTTP 200 responses. This occurs when an unauthenticated attacker ap...