Scanners turned a Vite file-read bypass into a wordlist sweep for .env files

A file-read bypass in the Vite development server was published on April 7, 2026, scored 7.5 on CVSS, and requires no authentication ^[5]. By August, F5 Labs was logging it as a sustained scanning operation against its honeynet sensors: 807 session-grouped attacks and roughly 32,000 raw events over the monthly analysis window, aimed at pulling cloud credentials and infrastructure-as-code state files out of exposed development servers ^[1][2]. Publication to commodity scanning traffic took about four months ^[17].

The fleet cycled through extensive wordlists of environment files, AWS keys, Azure tokens and IaC state files ^[4]. Roughly 32,000 events spread across 807 sessions works out at about 40 requests per session ^[16].

How the deny list gets walked past

Vite's development server exposes an internal `@fs` route so it can serve files from the host filesystem, and it relies on a deny-list setting, `server.fs.deny`, to block sensitive items such as `.env` files, certificates and private application source ^[6]. CVE-2026-39364 defeats that setting with query parameters. Append `?raw`, `?import&raw` or `?import&url&inline` and the server stops enforcing the filter, returning the target file with an HTTP 200 ^[7].

F5 breaks the chain into three stages. An unauthenticated scanner sends a GET to `/@fs/` referencing a sensitive path with the bypass parameters attached; the server normalizes the path and strips or misinterprets the query string while validating access, so the `server.fs.deny` check never fires; the file comes back in plaintext in the response body ^[9]. Affected versions run from 7.1.0 up to, but not including, 7.3.2 and 8.0.5 ^[5].

There is one real precondition, and it is a configuration choice. Vite binds to localhost by default, so the service has to be published: someone passes `--host`, sets `server.host`, or maps a Docker container port wrongly ^[8]. Pointed at a configuration directory, a successful read gives immediate access to plaintext API secrets, database passwords and cloud administrative credentials ^[14].

The evasion in the probe strings is aimed at the middleboxes. Alongside requests such as `GET /@fs/.env?raw??` and `GET /@fs/../.env?raw??`, F5 logged double-encoded traversal using `%252f`, which it describes as an attempt to bypass normalization routines in intermediate reverse proxies and web application firewalls ^[11].

What 807 sessions count

Three event classes carry the campaign in F5's telemetry: Information Leakage at 32,010 events, Predictable Resource Location at 1,729, and Path Traversal at 1,586 ^[10]. Those three add up to 35,325, roughly 3,300 more than the approximately 32,000 raw events given for the same window, and the write-up does not reconcile the two figures ^[15].

The bigger caveat is about the denominator. These are counts from honeynet sensors ^[1]. They count requests. The share of real estates that answer one with a 200 is a separate measurement, and this kind of telemetry does not produce it.

Severity scores and what actually fires

Older Vite access-control flaws kept firing in the same window: CVE-2025-30208 at CVSS 5.3, CVE-2025-31125 at 5.3, and CVE-2024-45811 at 4.8 ^[12]. Of the cluster, only CVE-2025-31125 appears on CISA's Known Exploited Vulnerabilities catalog ^[13]. F5's own assessment is that the simplicity of the query-string trick makes exploitation trivial against any reachable server ^[13].

A CVSS score ranks the consequence of a successful read. A KEV listing records that exploitation has been observed and confirmed. An operator who wants to know which strings a scanning fleet already has loaded has to look somewhere else ^[16].

The coordination desk closes on September 17

The OpenJS Foundation CNA will pause its security operations from September 17 to October 6, 2026, both dates included, and return on October 7 ^[18]. The gap is 20 days ^[29]. Express, an OpenJS-hosted project, is joining the break ^[21], which also coincides with the Node.js Collaborator Summit ^[22].

The stated cause is load. The Foundation says the volume of advisories and CVE requests it coordinates has grown sharply, that a significant part of the growth comes from reports generated or assisted by large language models, and that many are low signal but still need careful human review to separate real issues from noise ^[19]. The CNA team wrote that "AI has lowered the barrier to generating security reports, but not the cost of handling them, and volunteer availability does not scale with report volume" ^[20].

There is a precedent in the post: the Foundation writes that the curl project ran a month-long pause on vulnerability intake it called "Summer of Bliss", described it afterwards as one of their best decisions in a long while, and that the experience showed a clearly announced break can give maintainers real rest without meaningful security consequences ^[23]. During the OpenJS pause, actively exploited vulnerabilities and critical issues posing immediate risk still get a response, through the public #security channel on the Foundation's Slack, with a request to keep the first message high-level and mark it urgent ^[24].

Nothing in either publication connects the scanning campaign to the pause. The dates overlap. What the two documents share is a subject: the same window in which a four-month-old bypass became automated credential harvesting is the window in which one ecosystem's CVE coordination is deliberately reduced to an emergency channel. Node.js also edited the definitions in the same period, listing a commit from James M Snell in the 26.8.2 changelog titled "meta: refine the security vuln posture for experimental features" ^[28].

A control that expires by itself

npm shipped the other kind of answer on September 9. Any account that signs in with a recovery code now gets a temporary 72-hour security hold, a protection that previously applied only to high-impact accounts ^[25]. During the hold, publishing and other security-sensitive writes are paused, including creating access tokens, while sign-in, browsing and installing keep working ^[26]. The hold expires automatically, with no action or support request needed to restore full access ^[26]. npm describes the goal as slowing account-takeover attempts and reducing the risk of malicious publishing from a compromised recovery code ^[27].

The npm hold assumes a stolen credential will be used at some point and inserts three days of friction on the write path without anyone being awake to authorise it. Coordinated disclosure assumes a volunteer reads the report. The npm hold needs no human across the twenty days; the CVE triage the OpenJS post is cutting back needs one ^[18][19].

For anyone running a development server on a published port, what matters is narrow, and it does not depend on the AI-report argument at all. The bypass needs no account, the query parameters walk past the deny list, and the paths in the wordlists are the ones holding plaintext secrets ^[5][7][4]. F5's conclusion from the traffic is that the rapid increase from baseline background noise shows how quickly newly disclosed bypass methods get folded into automated credential-harvesting operations ^[32].