{"id":"CVE-2026-112947","kind":"vulnerability","aliases":["CVE-2026-112947","GHSA-vfpm-58rq-9qcg"],"related":[],"title":"Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`","description":"### Summary\n\nThe first 4 bytes of files outside of `server.fs` setting can be returned to the browser by a request containing `?vite-wasm-instance`.\n\n### Impact\n\n Only apps that match one of the following conditions are affected:\n\n- explicitly expose the Vite dev server to the network using `--host` or the [`server.host`](https://vite.dev/config/server-options#server-host) option\n- there's a file that has a sensitive information in **the first 4 bytes**\n- uses Node.js or Deno to run Vite (if Bun is used, it is not affected)\n\n### Details\nRequests containing the `?vite-wasm-instance` query are handled by the internal Wasm plugin's `load` hook. The hook removes the query and reads the resulting path directly from disk, but the `server.fs` checks were not applied.\n\nAfter reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file.\n\n### PoC\n\nCreate a denied file and start an affected Vite dev server:\n\n```bash\necho 'SECRET_KEY=abc123\\n' > .env\nnpm run dev\ncurl 'http://localhost:5173/.env?vite-wasm-instance'\n```\n\nThis will show\n```\nFailed to parse WASM file \"<root>/.env\": WebAssembly.compile(): expected magic word 00 61 73 6d, found 53 45 43 52 @+0\n```","summary":"Vite's dev server returns the first 4 bytes of files outside the server.fs allow list when a request includes ?vite-wasm-instance, because the internal Wasm plugin reads the file without the fs checks and includes the bytes in a WebAssembly parse error. An attacker who can reach the dev server can read the first 4 bytes of arbitrary readable files, such as secrets placed at the start of a file like .env.","severity":"medium","cvss":6.3,"epss":0.004220000002533197,"exploited":false,"exploited_at":null,"products":[{"name":"vite","fixed":["8.3.3"],"affected":">= 8.3.0, <= 8.3.2","ecosystem":"npm"},{"name":"vite","fixed":["8.2.4"],"affected":">= 8.2.0, <= 8.2.3","ecosystem":"npm"},{"name":"vite-plus","fixed":["1.1.0"],"affected":">= 0.2.8, <= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-200","cwe-209","cwe-22","deno","node.js","npm","package","self-hosted","vite"],"not_affected_if":["bun-runtime","default-config","vite-version-outside-range"],"how_to_check":"Run npm ls vite (or check the lockfile) and confirm whether the installed version is in the affected ranges: vite 8.3.0 to 8.3.2, vite 8.2.0 to 8.2.3, or vite-plus 0.2.8 to 1.0.0.\nCheck whether the dev server is exposed with --host or server.host in vite.config.\nRuntime must be Node.js or Deno; Bun is not affected per the advisory.","fix":"Upgrade vite to 8.3.3 (on the 8.3 line) or 8.2.4 (on the 8.2 line); upgrade vite-plus to 1.1.0.\nUntil upgraded, do not expose the dev server to the network (remove --host and server.host).","status":"open","published_at":"2026-10-20T16:17:05+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:10:29+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:10:29Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade vite to 8.3.3 (on the 8.3 line) or 8.2.4 (on the 8.2 line); upgrade vite-plus to 1.1.0.\nUntil upgraded, do not expose the dev server to the network (remove --host and server.host).","summary":"Vite's dev server returns the first 4 bytes of files outside the server.fs allow list when a request includes ?vite-wasm-instance, because the internal Wasm plugin reads the file without the fs checks and includes the bytes in a WebAssembly parse error. An attacker who can reach the dev server can read the first 4 bytes of arbitrary readable files, such as secrets placed at the start of a file like .env.","category":"package","who_cares":["vite","npm","node.js","deno","self-hosted"],"confidence":0.85,"analyst_note":"","how_to_check":"Run npm ls vite (or check the lockfile) and confirm whether the installed version is in the affected ranges: vite 8.3.0 to 8.3.2, vite 8.2.0 to 8.2.3, or vite-plus 0.2.8 to 1.0.0.\nCheck whether the dev server is exposed with --host or server.host in vite.config.\nRuntime must be Node.js or Deno; Bun is not affected per the advisory.","needs_analyst":false,"not_affected_if":["bun-runtime","default-config","vite-version-outside-range"],"severity_if_unknown":"medium"},"cost_usd":0.000504,"input_tokens":2535,"output_tokens":500,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'+0':327C '-112947':20A,28A '-200':35B '-2026':19A,27A '-209':37B '-22':39B '/.env':313C '/config/server-options#server-host)':176C '00':318C '4':3A,55B,105B,126C,190C,271C '43':325C '45':324C '5173/.env':300C '52':326C '53':323C '58rq':24A '61':319C '6d':321C '73':320C '9qcg':25A 'abc123':292C 'affect':159C,206C,284C 'allow':62B 'app':150C 'appli':245C 'arbitrari':108B 'attack':94B 'attempt':251C 'bash':288C 'browser':139C 'bun':200C 'byte':4A,56B,87B,106B,127C,191C,272C 'check':83B,242C 'condit':157C 'contain':143C,209C,268C 'creat':277C 'curl':298C 'cve':18A,26A 'cwe':34B,36B,38B 'deni':279C 'deno':40B,195C,263C 'detail':207C 'dev':50B,99B,164C,286C,297C 'direct':236C 'disk':238C 'echo':289C 'env':122B,294C 'error':92B,266C 'expect':315C 'explicit':160C 'expos':12A,161C 'fail':260C,308C 'file':6A,58B,79B,110B,120B,129C,181C,249C,275C,280C,312C 'first':2A,54B,104B,125C,189C,270C 'follow':156C 'found':322C 'fs':82B 'ghsa':22A 'ghsa-vfpm-58rq-9qcg':21A 'handl':217C 'hook':225C,227C 'host':46B,170C 'impact':148C 'includ':67B,85B 'inform':186C 'instanc':17A,71B,147C,214C,304C 'intern':74B,220C 'key':291C 'like':121B 'list':63B 'load':224C 'localhost':299C 'magic':316C 'match':152C 'n':293C 'network':168C 'node':261C 'node.js':41B,193C 'npm':42B,295C 'one':153C 'option':177C 'outsid':7A,59B,130C 'packag':43B 'pars':91B,253C,259C,310C 'path':235C 'place':114B 'plugin':76B,222C 'plus':33A 'poc':276C 'queri':215C,230C 'reach':97B 'read':77B,102B,232C,247C 'readabl':109B 'remov':228C 'request':66B,142C,208C 'result':234C 'return':52B,136C 'run':197C,296C 'secret':113B,290C 'self':45B 'self-host':44B 'sensit':185C 'server':51B,100B,165C,287C 'server.fs':9A,61B,132C,241C 'server.host':173C 'set':10A,133C 'show':307C 'start':117B,282C 'summari':123C 'throw':264C 'use':169C,192C,202C 'vfpm':23A 'vite':1A,15A,29A,30A,32A,47B,48B,69B,145C,163C,198C,212C,250C,285C,302C 'vite-plus':31A 'vite-wasm-inst':14A,68B,144C,211C,301C 'vite.dev':175C 'vite.dev/config/server-options#server-host)':174C 'wasm':16A,70B,75B,146C,213C,221C,303C,311C 'webassembl':90B,256C 'webassembly.compile':314C 'without':80B 'word':317C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vfpm-58rq-9qcg","url":"https://github.com/advisories/GHSA-vfpm-58rq-9qcg","severity":"medium","published_at":"2026-10-21T16:47:15+00:00","modified_at":"2026-10-21T16:47:16+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112947","severity":null,"published_at":"2026-10-20T16:17:05+00:00","modified_at":"2026-10-21T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}