security_identifier

CVE-2026-39364

Identifier for a high-severity access control bypass in Vite's development server, in which appended query parameters defeat the server.fs.deny file deny list and return blocked files in plaintext.

Known aliases

server.fs.deny bypass

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

A query string walks past server.fs.deny on Vite dev servers left on a public port

F5 counted about 32,000 events in August aimed at .env files and cloud credentials on internet-reachable Vite development servers. The fixed builds are 7.3.2 and 8.0.5, and the advice pairs them with binding the server back to localhost.

Publishers:dev.to

Reality

Evidence62
Adoption45
Hype gap+12
Incentives55
Confidence58

security2 publishers

Mass scanners are pulling AWS keys and Terraform state from Vite dev servers exposed with --host

F5 Labs logged more than 800 attacks and about 32,000 raw events against its honeypots in a month, using an April bypass of Vite's server.fs.deny to read .env files, cloud credentials and terraform.tfstate.

Publishers:bleepingcomputer.comthehackernews.com

Reality

Evidence66
Adoption55
Hype gap+15
Incentives55
Confidence68