CVE-2026-112947: Vite Path Traversal Vulnerability

CVE-2026-112947 Overview

CVE-2026-112947 is a path traversal vulnerability in Vite, a frontend build tool for JavaScript applications. The flaw allows a remote attacker to read the first 4 bytes of arbitrary files on the host running the Vite development server. Affected versions include Vite 8.2.0 through 8.2.3 and the 8.3.x line prior to 8.3.3. The issue stems from the internal WebAssembly plugin's load hook, which bypasses the server.fs allow-list when a request includes the ?vite-wasm-instance query string. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact

Remote attackers can leak the first 4 bytes of files outside the configured server.fs allow-list, enabling fingerprinting of sensitive files such as credentials, keys, or configuration data on developer machines.

Affected Products

• Vite 8.2.0 through 8.2.3
• Vite 8.3.0 through 8.3.2
• Projects consuming the Vite development server with ?vite-wasm-instance handling

Discovery Timeline

• 2026-10-20 - CVE-2026-112947 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-112947

Vulnerability Analysis

Vite exposes a development server that proxies file reads to the browser for module transformation. The server enforces an server.fs allow-list to prevent requests from reading files outside the project root. CVE-2026-112947 bypasses this allow-list for any URL containing the ?vite-wasm-instance query parameter.

When the Vite internal Wasm plugin's load hook receives such a request, it strips the query, resolves the resulting path on disk, and reads the file directly. The isServerAccessDeniedForTransform check that normally guards ?raw, ?inline, and .svg requests was never applied to the Wasm instance query. After reading, Vite attempts to parse the content as WebAssembly. Parsing fails on non-Wasm input, and the underlying Node.js and Deno runtimes raise an error that embeds the first 4 bytes of the file in the message.

Root Cause

The root cause is a missing authorization check in the request-routing logic. The regex set used by isServerAccessDeniedForTransform did not include the vite-wasm-instance query, so the server.fs.allow and server.fs.deny policies were never consulted for this code path.

Attack Vector

An attacker lures a developer to visit a malicious website while the Vite dev server is running on localhost. The site issues cross-origin requests to the Vite server with crafted paths such as /etc/passwd?import&vite-wasm-instance. The server returns the first 4 bytes of the targeted file inside the Wasm parse error response, which the attacker can read and exfiltrate.

// Patch: packages/vite/src/node/server/middlewares/transform.ts
 const rawRE = /[?&]raw\b/
 const inlineRE = /[?&]inline\b/
 const svgRE = /\.svg\b/
+const wasmInstanceRE = /[?&]vite-wasm-instance(?:&|$)/
 
 export function isServerAccessDeniedForTransform(
   config: ResolvedConfig,
   id: string,
 ): boolean {
-  if (rawRE.test(id) || urlRE.test(id) || inlineRE.test(id) || svgRE.test(id)) {
+  if (
+    rawRE.test(id) ||
+    urlRE.test(id) ||
+    inlineRE.test(id) ||
+    svgRE.test(id) ||
+    wasmInstanceRE.test(id)
+  ) {
     return (
       checkLoadingAccess(config, cleanUrl(id)) !== 'allowed' ||
       checkLoadingAccess(config, id) !== 'allowed'

Source: Vite commit b6c6d2fb

Detection Methods for CVE-2026-112947

Indicators of Compromise

• HTTP requests to the Vite dev server containing the ?vite-wasm-instance query parameter targeting paths outside the project root.
• Request URIs that combine ?import with vite-wasm-instance, for example /unsafe.json?import&vite-wasm-instance.
• Repeated Wasm parse error entries in Vite server logs for files that are not WebAssembly modules.

Detection Strategies

• Inspect dev-server access logs for query strings matching the regex [?&]vite-wasm-instance(?:&|$) against non-Wasm paths.
• Alert on cross-origin requests originating from unexpected Origin or Referer headers hitting localhost Vite ports.
• Review Node.js and Deno process stderr for WebAssembly compilation errors referencing files outside the project directory.

Monitoring Recommendations

• Instrument developer workstations to log outbound browser requests to local development ports.
• Track installed Vite versions across engineering environments via package manifests (package.json, pnpm-lock.yaml).
• Centralize dev-server telemetry so unusual file-read patterns can be correlated across machines.

How to Mitigate CVE-2026-112947

Immediate Actions Required

• Upgrade Vite to version 8.2.4 or 8.3.3 across all development environments.
• Audit package.json and lockfiles to confirm no transitive dependency pins a vulnerable Vite version.
• Restart any running vite dev-server processes after upgrading.

Patch Information

The fix adds the wasmInstanceRE regex to the isServerAccessDeniedForTransform function in packages/vite/src/node/server/middlewares/transform.ts. The patched function now enforces checkLoadingAccess against the server.fs policy for any request containing ?vite-wasm-instance. See the GitHub Security Advisory GHSA-vfpm-58rq-9qcg and the upstream pull request #23655 for the complete remediation.

Workarounds

• Bind the Vite dev server to a non-routable interface and avoid exposing it on 0.0.0.0.
• Restrict server.fs.allow to the minimum directories required for the build.
• Use a browser profile dedicated to development that does not load untrusted third-party sites during active vite sessions.

# Upgrade Vite to a patched release
npm install --save-dev vite@8.3.3
# or for the 8.2.x line
npm install --save-dev vite@8.2.4

# Verify installed version
npx vite --version