CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112945

The Vite frontend tooling framework is vulnerable to cross-origin script execution when using custom middleware. Specifically, versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3 may pass an unchanged browser request URL to server.transformIndexHtml. The getHtmlFilename function uses the quer...