Incorrect Behavior Order: Validate Before Canonicalize in Vite - CVE-2026-39364
Published: April 8, 2026
Vulnerability identifier: #VU125311
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39364
CWE-ID: CWE-180
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to validate-before-canonicalize behavior in the Vite dev server file access control for server.fs.deny when handling requests for denied files with query parameters such as ?raw, ?import&raw, or ?import&url&inline. A remote attacker can send a specially crafted request to disclose sensitive information.
Only applications that explicitly expose the Vite dev server to the network are affected, and the targeted file must exist in directories allowed by server.fs.allow while matching a deny pattern in server.fs.deny.
Affected software
Vite
How to mitigate CVE-2026-39364
Install security update from vendor's website.
Vite - addressed in versions 7.3.2, 8.0.5