CVE-2026-39365: Vite Path Traversal Vulnerability

CVE-2026-39365 Overview

A path traversal vulnerability has been identified in Vite, a popular frontend tooling framework for JavaScript. The vulnerability exists in the development server's handling of .map requests for optimized dependencies. The server resolves file paths and calls readFile without properly restricting ../ path traversal segments in the URL. This allows attackers to bypass the server.fs.strict allow list and retrieve .map files located outside the project root directory, provided they can be parsed as valid source map JSON.

Critical Impact

Attackers can bypass filesystem security restrictions to access sensitive source map files outside the intended project directory, potentially exposing proprietary source code and configuration details.

Affected Products

• Vite versions 6.0.0 to before 6.4.2
• Vite versions 7.x to before 7.3.2
• Vite versions 8.x to before 8.0.5

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-39365 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39365

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), a well-known weakness that occurs when software uses external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory, but fails to properly neutralize special elements within the pathname.

In the context of Vite's development server, the vulnerability manifests when handling requests for source map (.map) files associated with optimized dependencies. The server's file resolution logic does not adequately sanitize URL paths containing directory traversal sequences such as ../. This oversight allows an attacker to craft malicious requests that escape the intended project root directory.

The server.fs.strict configuration option, which is designed to restrict file access to within the project workspace, can be effectively bypassed through this path traversal technique. However, the exploitability is somewhat limited by the requirement that retrieved files must be parseable as valid JSON source map files.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within Vite's development server request handler. When processing requests for .map files of optimized dependencies, the server constructs file paths by directly incorporating URL segments without first neutralizing path traversal sequences. The readFile operation is then called on these unsanitized paths, allowing access to files outside the designated project directory structure.

Attack Vector

The vulnerability is exploitable over the network when a Vite development server is accessible to an attacker. An attacker can send specially crafted HTTP requests to the development server containing path traversal sequences targeting .map files outside the project root.

The attack scenario involves:

1. Identifying a Vite development server exposed on the network
2. Crafting a request URL containing ../ sequences targeting source map files outside the project directory
3. The server processes the request, resolving the path without sanitization
4. If the targeted file exists and can be parsed as valid source map JSON, its contents are returned to the attacker

The vulnerability mechanism involves manipulating the URL path in requests to the development server. By including path traversal sequences such as ../, an attacker can navigate outside the project root directory. The server's readFile function processes these paths without proper sanitization, bypassing the server.fs.strict security control. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-39365

Indicators of Compromise

• HTTP requests to the development server containing ../ path traversal sequences targeting .map files
• Unusual access patterns to source map endpoints with deep directory navigation
• Server logs showing requests for .map files with paths referencing directories outside the project root
• Unexpected file access events triggered by the Node.js process running the Vite dev server

Detection Strategies

• Monitor web server access logs for requests containing path traversal patterns (e.g., ../, ..%2F, ..%5C) targeting .map endpoints
• Implement intrusion detection rules that alert on directory traversal attempts in HTTP requests
• Review application firewall logs for blocked path traversal attempts that may indicate reconnaissance
• Audit development server configurations to ensure server.fs.strict is enabled and properly configured

Monitoring Recommendations

• Deploy web application firewall (WAF) rules to detect and block path traversal attempts
• Enable verbose logging on Vite development servers to capture detailed request information
• Set up alerting for anomalous file access patterns from Node.js processes
• Regularly audit which network interfaces the development server is bound to

How to Mitigate CVE-2026-39365

Immediate Actions Required

• Upgrade Vite to a patched version: 6.4.2, 7.3.2, or 8.0.5 depending on your major version
• Restrict network access to development servers by binding to localhost only
• Ensure development servers are not exposed to untrusted networks or the public internet
• Review server logs for any evidence of exploitation attempts

Patch Information

The vulnerability has been fixed in Vite versions 6.4.2, 7.3.2, and 8.0.5. Organizations should update to the appropriate patched version based on their current major version:

For additional details, see the GitHub Security Advisory.

Workarounds

• Bind the Vite development server to localhost or 127.0.0.1 to prevent external network access
• Implement network-level access controls to restrict who can reach the development server
• Use a reverse proxy with path filtering to block requests containing traversal sequences
• Avoid running development servers in production or publicly accessible environments

# Configuration example - Bind Vite dev server to localhost only
# In vite.config.js or vite.config.ts:
# server: {
#   host: '127.0.0.1',
#   fs: {
#     strict: true,
#     allow: ['.']
#   }
# }

# Upgrade to patched version using npm
npm update vite@latest

# Or install specific patched version
npm install vite@6.4.2  # For v6.x users
npm install vite@7.3.2  # For v7.x users
npm install vite@8.0.5  # For v8.x users