CVE-2026-39365
Vite has a Path Traversal in Optimized Deps `.map` Handling
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Vite has a Path Traversal in Optimized Deps `.map` Handling
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
- Record
CVE-2026-39365- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-19875
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
- Record
EUVD-2026-19875- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
- Record
CVE-2026-39365- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Vite has a Path Traversal in Optimized Deps `.map` Handling
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
- Record
CVE-2026-39365- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-04
OSVROOT-APP-NPM-CVE-2026-39365
CVE-2026-39365 in vite - Patched by Root
Root has patched CVE-2026-39365 in the vite package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-39365- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1777855413 No score
TuxCare security update for vite (4 CVEs)
TuxCare rebuilt vite to address 4 CVEs. Fixed in 3.2.11-tuxcare.2.
- Record
CLSA-2026-1777855413- Updated
- 2026-11-02
Show 8 moreShow less
OSVCLSA-2026-1777855416 No score
TuxCare security update for vite (4 CVEs)
TuxCare rebuilt vite to address 4 CVEs. Fixed in 4.5.14-tuxcare.1.
- Record
CLSA-2026-1777855416- Updated
- 2026-11-02
OSVCLSA-2026-1778201087 No score
TuxCare security update for vite (1 CVE)
TuxCare rebuilt vite to address 1 CVE. Fixed in 5.4.21-tuxcare.1.
- Record
CLSA-2026-1778201087- Updated
- 2026-11-02
OSVCLSA-2026-1789031855 No score
TuxCare security update for vite (16 CVEs)
TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.
- Record
CLSA-2026-1789031855- Updated
- 2026-11-02
OSVCLSA-2026-1790080922 No score
TuxCare security update for vite (2 CVEs)
TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.4.14-tuxcare.3.
- Record
CLSA-2026-1790080922- Updated
- 2026-11-02
OSVCLSA-2026-1790776710 No score
TuxCare security update for vite (2 CVEs)
TuxCare rebuilt vite to address 2 CVEs. Fixed in 6.4.3-tuxcare.1.
- Record
CLSA-2026-1790776710- Updated
- 2026-11-02
OSVCLSA-2026-1791897792 No score
TuxCare security update for vite (8 CVEs)
TuxCare rebuilt vite to address 8 CVEs. Fixed in 5.4.10-tuxcare.4.
- Record
CLSA-2026-1791897792- Updated
- 2026-11-02
OSVCLSA-2026-1792225951 No score
TuxCare security update for @vitejs/plugin-react (4 CVEs)
TuxCare rebuilt @vitejs/plugin-react to address 4 CVEs. Fixed in 3.2.11-tuxcare.2.
- Record
CLSA-2026-1792225951- Updated
- 2026-11-02
OSVCLSA-2026-1793091335 No score
TuxCare security update for vite (3 CVEs)
TuxCare rebuilt vite to address 3 CVEs. Fixed in 6.4.2-tuxcare.6.
- Record
CLSA-2026-1793091335- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
viteTuxCare:npm From an advisory covering 4 CVEs |
3.2.11-tuxcare.0 up to 3.2.11-tuxcare.2, plus listed versions 3.2.113.2.11-tuxcare.1 |
3.2.11-tuxcare.2 |
viteTuxCare:npm From an advisory covering 4 CVEs |
4.5.14-tuxcare.0 up to 4.5.14-tuxcare.1, plus listed versions 4.5.14 |
4.5.14-tuxcare.1 |
viteTuxCare:npm |
5.4.21-tuxcare.0 up to 5.4.21-tuxcare.1, plus listed versions 5.4.21 |
5.4.21-tuxcare.1 |
viteTuxCare:npm From an advisory covering 16 CVEs |
4.1.5-tuxcare.0 up to 4.1.5-tuxcare.1, plus listed versions 4.1.5 |
4.1.5-tuxcare.1 |
viteTuxCare:npm From an advisory covering 2 CVEs |
5.4.14-tuxcare.0 up to 5.4.14-tuxcare.3, plus listed versions 5.4.145.4.14-tuxcare.15.4.14-tuxcare.2 |
5.4.14-tuxcare.3 |
viteTuxCare:npm From an advisory covering 2 CVEs |
6.4.3-tuxcare.0 up to 6.4.3-tuxcare.1, plus listed versions 6.4.3 |
6.4.3-tuxcare.1 |
viteTuxCare:npm From an advisory covering 8 CVEs |
5.4.10-tuxcare.0 up to 5.4.10-tuxcare.4, plus listed versions 5.4.105.4.10-tuxcare.15.4.10-tuxcare.25.4.10-tuxcare.3 |
5.4.10-tuxcare.4 |
@vitejs/plugin-reactTuxCare:npm From an advisory covering 4 CVEs |
3.2.11-tuxcare.0 up to 3.2.11-tuxcare.2, plus listed versions 3.2.113.2.11-tuxcare.1 |
3.2.11-tuxcare.2 |
viteTuxCare:npm From an advisory covering 3 CVEs |
6.4.2-tuxcare.0 up to 6.4.2-tuxcare.6, plus listed versions 6.4.26.4.2-tuxcare.16.4.2-tuxcare.26.4.2-tuxcare.36.4.2-tuxcare.46.4.2-tuxcare.5 |
6.4.2-tuxcare.6 |
viteRoot:npm |
before 5.4.21-aikido.2 | 5.4.21-aikido.25.4.21-aikido.35.4.21-aikido.4 |
@rootio/viteRoot:npm |
before 5.4.21-root.io.1 | 5.4.21-root.io.15.4.21-root.io.25.4.21-root.io.35.4.21-root.io.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Vite Dev Server - Path Traversal in Optimized Deps .map Handling |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-39365 is a medium vulnerability (CVSS 6.3) in Vitejs Vite, published April 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in vite 5.4.21-tuxcare.1.