{"id":1728,"date":"2026-09-17T12:10:50","date_gmt":"2026-09-17T06:40:50","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1728"},"modified":"2026-09-21T12:45:29","modified_gmt":"2026-09-21T07:15:29","slug":"vite-cve-2026-39364","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/vite-cve-2026-39364\/","title":{"rendered":"Vite CVE-2026-39364 Exploitation: Exposed Dev Servers Targeted for AWS and Azure Secrets"},"content":{"rendered":"

Internet-exposed Vite development servers are facing mass scanning designed to uncover cloud credentials and infrastructure secrets. F5 Labs recorded 807 session-grouped attacks and roughly 32,000 raw events<\/a> during August 2026. The activity included probes matching Vite CVE-2026-39364, alongside attempts targeting older Vite file-access flaws. Attackers systematically requested .env<\/code> files, AWS credentials, Azure data, Terraform state files and process environment data.<\/p>\n

Vite CVE-2026-39364 is a high-severity file-read vulnerability that can bypass server.fs.deny<\/code> through crafted query parameters. Vite 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 are affected. Versions 7.3.2 and 8.0.5 contain the fix. The Vite advisory assigns the vulnerability a CVSS v4.0 score of 8.2.<\/p>\n

Importantly, F5’s telemetry confirms scanning and attempts to retrieve sensitive files. The available reporting does not establish that every request succeeded or that specific AWS or Azure accounts were subsequently compromised.<\/p>\n

Vite CVE-2026-39364 at a Glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Detail<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
CVE<\/span><\/b>\u00a0<\/span><\/td>\nCVE-2026-39364<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Product<\/span><\/b>\u00a0<\/span><\/td>\nVite development server<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Vulnerability<\/span><\/b>\u00a0<\/span><\/td>\nserver.fs.deny<\/code> file-access bypass<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Severity<\/span><\/b>\u00a0<\/span><\/td>\nHigh<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVSS<\/span><\/b>\u00a0<\/span><\/td>\n8.2, CVSS v4.0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Authentication<\/span><\/b>\u00a0<\/span><\/td>\nNone\u00a0required<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Affected Vite versions<\/span><\/b>\u00a0<\/span><\/td>\n7.1.0\u20137.3.1 and 8.0.0\u20138.0.4<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Fixed versions<\/span><\/b>\u00a0<\/span><\/td>\n7.3.2 and 8.0.5<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exposure condition<\/span><\/b>\u00a0<\/span><\/td>\nVite development server exposed to the network, with\u00a0additional\u00a0filesystem conditions<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Observed activity<\/span><\/b>\u00a0<\/span><\/td>\nMass scanning and credential\/configuration-file probing<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CISA KEV<\/span><\/b>\u00a0<\/span><\/td>\nNot listed as of this review<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How Vite CVE-2026-39364 Bypasses server.fs.deny<\/h2>\n

CVE-2026-39364 allows unauthenticated attackers to bypass Vite’s server.fs.deny<\/code> restrictions with crafted query parameters. Exploitation requires a network-accessible development server and specific filesystem conditions.<\/p>\n

Vite uses server.fs.deny<\/code> to prevent its development server from serving sensitive files. Its default deny list covers files such as .env<\/code>, certificates, private keys and package-manager configuration files.<\/p>\n

However, CVE-2026-39364 can bypass this restriction under specific conditions. By appending query parameters such as ?raw<\/code>, ?import&raw<\/code>, or ?import&url&inline<\/code>, an unauthenticated attacker can retrieve files protected by server.fs.deny<\/code> with an HTTP 200 response.<\/p>\n

An affected application must meet three conditions:<\/p>\n