A file-disclosure flaw in the Vite frontend build tool's dev server that lets files the server is configured to deny — .env, *.crt and similar — be retrieved with HTTP 200 responses when specific query parameters are appended to the request. NVD scores it 8.2 (High, CVSS 4.0).
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-39364 |
| CVSS | 8.2 (CVSS 4.0) (High) |
| Vendor / product | Vite / Vite dev server 7.1.0–7.3.2 and 8.x before 8.0.5 |
| Reported | 2026-09-16 |
The vulnerability matters because of how Vite dev servers are used rather than how they are built: F5 documented a month-long campaign stripping cloud credentials from exposed Vite dev servers, and this is the flaw that chain depends on. A developer machine or CI runner that exposes the dev server to a network hands over environment files that routinely hold cloud keys, tokens and database credentials — the exact material the campaign harvested. The mitigation is version hygiene plus not binding the dev server to a reachable interface; the exposure check is a Shodan-style sweep for Vite dev-server banners on your own address space.