{"id":"CVE-2026-53571","aliases":["CLSA-2026-1784423356","CLSA-2026-1784596270","CLSA-2026-1784683083","CLSA-2026-1786362148","CLSA-2026-1787839491","CLSA-2026-1788814439","CLSA-2026-1788966294","CLSA-2026-1788967519","CLSA-2026-1788976179","CLSA-2026-1789031855","CLSA-2026-1789032018","CLSA-2026-1790080922","CLSA-2026-1790758113","CLSA-2026-1790759630","CLSA-2026-1791795546","CLSA-2026-1791807914","CLSA-2026-1791897792","CLSA-2026-1792225953","CLSA-2026-1792225954","EUVD-2026-38303","GHSA-fx2h-pf6j-xcff","ROOT-APP-NPM-CVE-2026-53571"],"status":"published","title":"Vite: `server.fs.deny` bypass on Windows alternate paths","description":"Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00577,"percentile":0.47815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200","CWE-22"],"published":"2026-06-15T17:17:45Z","modified":"2026-11-04T10:47:22Z","exploits":[{"source":"pocgithub","id":"TazmiDev/CVE-2026-53571","title":"TazmiDev/CVE-2026-53571","date":"2026-07-09","url":"https://github.com/TazmiDev/CVE-2026-53571"}],"fixes":[{"ecosystem":"npm","package":"vite","fixed_in":["8.0.16","7.3.5","6.4.3"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite-plus","fixed_in":["0.1.24"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"vite","fixed_in":["5.4.21-tuxcare.2","6.4.2-tuxcare.1","3.2.11-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","fixed_in":["3.2.11-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"vite","fixed_in":["5.4.21-aikido.3","8.0.14-aikido.1","8.0.13-aikido.1","6.4.1-aikido.3","6.4.1-aikido.4","5.4.21-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vite","fixed_in":["5.4.21-root.io.3","8.0.14-root.io.1","8.0.13-root.io.1","6.4.1-root.io.3","6.4.1-root.io.4","5.4.21-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.0.15"},{"fixed":"8.0.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.3.4"},{"fixed":"7.3.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.2"},{"fixed":"6.4.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.23"},{"fixed":"0.1.24"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.21-tuxcare.0"},{"fixed":"5.4.21-tuxcare.2"}]}],"versions":["5.4.21","5.4.21-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.14-tuxcare.0"},{"fixed":"4.5.14-tuxcare.3"}]}],"versions":["4.5.14","4.5.14-tuxcare.1","4.5.14-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.2"}]}],"versions":["2.9.18","2.9.18-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.9"}]}],"versions":["4.5.5","4.5.5-tuxcare.1","4.5.5-tuxcare.2","4.5.5-tuxcare.3","4.5.5-tuxcare.4","4.5.5-tuxcare.5","4.5.5-tuxcare.6","4.5.5-tuxcare.7","4.5.5-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.2-tuxcare.0"},{"fixed":"6.4.2-tuxcare.1"}]}],"versions":["6.4.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.4"}]}],"versions":["3.2.11","3.2.11-tuxcare.1","3.2.11-tuxcare.2","3.2.11-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.12-tuxcare.0"},{"fixed":"8.0.12-tuxcare.1"}]}],"versions":["8.0.12"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.10-tuxcare.0"},{"fixed":"8.0.10-tuxcare.1"}]}],"versions":["8.0.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.2-tuxcare.0"},{"fixed":"7.3.2-tuxcare.1"}]}],"versions":["7.3.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.1"}]}],"versions":["4.1.5"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.8-tuxcare.0"},{"fixed":"8.0.8-tuxcare.1"}]}],"versions":["8.0.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.3"}]}],"versions":["5.4.14","5.4.14-tuxcare.1","5.4.14-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.9-tuxcare.0"},{"fixed":"8.0.9-tuxcare.1"}]}],"versions":["8.0.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.3-tuxcare.0"},{"fixed":"7.3.3-tuxcare.1"}]}],"versions":["7.3.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.12-tuxcare.0"},{"fixed":"5.0.12-tuxcare.4"}]}],"versions":["5.0.12","5.0.12-tuxcare.1","5.0.12-tuxcare.2","5.0.12-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.2"}]}],"versions":["4.5.0","4.5.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.10-tuxcare.0"},{"fixed":"5.4.10-tuxcare.4"}]}],"versions":["5.4.10","5.4.10-tuxcare.1","5.4.10-tuxcare.2","5.4.10-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.2"}]}],"versions":["2.9.18","2.9.18-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.4"}]}],"versions":["3.2.11","3.2.11-tuxcare.1","3.2.11-tuxcare.2","3.2.11-tuxcare.3"]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.16"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.5"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.3"}]}]},{"source":"osv","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.24"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.21-aikido.3"},{"fixed":"8.0.14-aikido.1"},{"fixed":"8.0.13-aikido.1"},{"fixed":"6.4.1-aikido.3"},{"fixed":"6.4.1-aikido.4"},{"fixed":"5.4.21-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.21-root.io.3"},{"fixed":"8.0.14-root.io.1"},{"fixed":"8.0.13-root.io.1"},{"fixed":"6.4.1-root.io.3"},{"fixed":"6.4.1-root.io.4"},{"fixed":"5.4.21-root.io.4"}]}]}],"products":[{"vendor":"vitejs","product":"vite"},{"vendor":"voidzero","product":"vite\\+"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53571","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53571.json","tags":["advisory"]},{"url":"https://github.com/vitejs/vite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53571","title":"Vite: `server.fs.deny` bypass on Windows alternate paths","description":"Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.","status":"published","published":"2026-06-22T16:10:58.5Z","modified":"2026-06-22T18:07:53.961Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-38303","description":"Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.","status":"published","published":"2026-06-22T16:10:58Z","modified":"2026-06-22T18:07:53Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:34.238696Z"}],"ghsa":[{"id":"GHSA-fx2h-pf6j-xcff","title":"vite: `server.fs.deny` bypass on Windows alternate paths","description":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- either of:\n  - the sensitive file exists in an NTFS volume\n  - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)\n\n### Details\n\nVite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.\nBecause of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.\n\nSimilar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\nAccess via browser at `http://localhost:5173/.env::$DATA?raw`\n\u003cimg width=\"388\" height=\"129\" alt=\"deecc1315123883cfd0f9c26a002845a\" src=\"https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170\" /\u003e\n\nExample expected result:\n- `/.env::$DATA?raw` returns the contents of `.env`\n- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`","status":"published","published":"2026-06-15T17:17:45Z","modified":"2026-10-27T14:58:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"nvd":[{"id":"CVE-2026-53571","description":"Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.","status":"published","published":"2026-06-22T18:16:44.667Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-53571","title":"Vite: `server.fs.deny` bypass on Windows alternate paths","description":"Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.","status":"published","published":"2026-06-22T16:10:58.5Z","modified":"2026-11-04T10:47:22.828457513Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-04T11:07:06.271559Z"},{"id":"GHSA-fx2h-pf6j-xcff","title":"vite: `server.fs.deny` bypass on Windows alternate paths","description":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- either of:\n  - the sensitive file exists in an NTFS volume\n  - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)\n\n### Details\n\nVite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.\nBecause of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.\n\nSimilar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\nAccess via browser at `http://localhost:5173/.env::$DATA?raw`\n\u003cimg width=\"388\" height=\"129\" alt=\"deecc1315123883cfd0f9c26a002845a\" src=\"https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170\" /\u003e\n\nExample expected result:\n- `/.env::$DATA?raw` returns the contents of `.env`\n- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`","status":"published","published":"2026-06-15T17:17:45Z","modified":"2026-10-27T15:15:07.885624041Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"CLSA-2026-1784423356","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 5.4.21-tuxcare.2.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-29T19:45:51.070431832Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784596270","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.14-tuxcare.3.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-29T19:45:49.540450122Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784683083","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 2.9.18-tuxcare.2.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-30T19:46:01.439880797Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1786362148","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.5-tuxcare.9.","status":"published","published":"2026-08-10T11:42:28Z","modified":"2026-10-29T19:45:50.128717503Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787839491","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 6.4.2-tuxcare.1.","status":"published","published":"2026-08-27T14:04:51Z","modified":"2026-10-15T09:48:03.112008826Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788814439","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 3.2.11-tuxcare.4.","status":"published","published":"2026-09-07T20:53:59Z","modified":"2026-10-29T19:45:49.192423278Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788966294","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.12-tuxcare.1.","status":"published","published":"2026-09-09T15:04:54Z","modified":"2026-10-15T09:47:55.530401842Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788967519","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.10-tuxcare.1.","status":"published","published":"2026-09-09T15:25:19Z","modified":"2026-10-15T09:47:55.530596475Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788976179","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 7.3.2-tuxcare.1.","status":"published","published":"2026-09-09T17:49:39Z","modified":"2026-10-15T09:47:55.542329089Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789031855","title":"TuxCare security update for vite (16 CVEs)","description":"TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.","status":"published","published":"2026-09-10T09:17:35Z","modified":"2026-10-15T09:47:55.69239765Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789032018","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.8-tuxcare.1.","status":"published","published":"2026-09-10T09:20:18Z","modified":"2026-10-15T09:47:55.637803071Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790080922","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.4.14-tuxcare.3.","status":"published","published":"2026-09-22T12:42:02Z","modified":"2026-10-29T19:45:50.666153399Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790758113","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.9-tuxcare.1.","status":"published","published":"2026-09-30T08:48:33Z","modified":"2026-10-15T09:47:53.548926037Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790759630","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 7.3.3-tuxcare.1.","status":"published","published":"2026-09-30T09:13:50Z","modified":"2026-10-15T09:47:57.307970895Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791795546","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.0.12-tuxcare.4.","status":"published","published":"2026-10-12T08:59:06Z","modified":"2026-10-15T09:47:39.913863975Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791807914","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.0-tuxcare.2.","status":"published","published":"2026-10-12T12:25:14Z","modified":"2026-10-15T09:47:40.2438322Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791897792","title":"TuxCare security update for vite (8 CVEs)","description":"TuxCare rebuilt vite to address 8 CVEs. Fixed in 5.4.10-tuxcare.4.","status":"published","published":"2026-10-13T13:23:12Z","modified":"2026-10-15T09:47:53.554887486Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792225953","title":"TuxCare security update for @vitejs/plugin-react (7 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 7 CVEs. Fixed in 2.9.18-tuxcare.2.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:24.727766679Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792225954","title":"TuxCare security update for @vitejs/plugin-react (1 CVE)","description":"TuxCare rebuilt @vitejs/plugin-react to address 1 CVE. Fixed in 3.2.11-tuxcare.4.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:23.773529811Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"ROOT-APP-NPM-CVE-2026-53571","title":"CVE-2026-53571 in vite - Patched by Root","description":"Root has patched CVE-2026-53571 in the vite package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-26T11:21:41Z","modified":"2026-10-26T12:15:03.069339703Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}