Do Son 
TL;DR
Attackers are mass-scanning the internet for exposed Vite development servers. They abuse the Vite development server vulnerability CVE-2026-39364 to steal cloud credentials and config files. F5 Labs recorded 807 grouped attacks and roughly 32,000 events in one month.
- Product: vite (npm)
- Vulnerabilities: 4 flaws (CVE-2026-39364, CVE-2025-30208, CVE-2025-31125, CVE-2024-45811)
- Highest severity: 8.2 (High · CVSSv4)
- Worst impact: has a `server.fs.deny` bypass with queries
- Status: 2 exploited; patches available
- Action: Update to 8.0.5, 7.3.2, 6.2.3, 6.1.2 (+14) now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-39364 | 8.2 | has a `server.fs.deny` bypass with queries | 8.0.5, 7.3.2 | Exploited in the wild |
| CVE-2024-45811 | 6.9 | CWE-200 | 5.4.6, 5.3.6, 4.5.4 (+3) | Not exploited |
| CVE-2025-30208 | 5.3 | CWE-200 | 6.2.3, 6.1.2, 6.0.12 (+2) | Not exploited |
| CVE-2025-31125 | 5.3 | CWE-200 | 6.2.4, 6.1.3, 6.0.13 (+2) | Exploited in the wild |
Track every F5 CVE the moment it's exploited.
Get free email alertsWhy this Vite vulnerability matters
Vite is a popular local development server and build tool. Developers sometimes expose it to the internet by mistake. When they do, this Vite development server vulnerability hands attackers plaintext secrets.
F5 Labs saw a sharp jump from normal background noise. As the advisory notes, the spike “highlights how quickly newly disclosed bypass methods are folded into automated credential-harvesting operations.” The stolen data includes API keys, database passwords, and cloud admin credentials.
How the attack works
Vite exposes an internal @fs route to serve files during development. A deny-list setting, server.fs.deny, is meant to block sensitive files. CVE-2026-39364 bypasses that guard through query-parameter tricks.
According to F5, appending parameters like ?raw or ?import&raw makes the server “bypass server.fs.deny configurations and retrieve restricted system and configuration files over HTTP.” The server then returns the file in plaintext with an HTTP 200 response. No authentication is required.
What attackers hunt for
The scanners cycle through large wordlists. Targets include .env files, AWS and Azure credentials, and Terraform state files. Some probes even read /proc/self/cwd/.env to grab the active config directly.
Affected versions
CVE-2026-39364 affects Vite 7.1.0 up to versions before 7.3.2 and 8.0.5. It carries a CVSS score of 7.5. Related bypass flaws co-fire in the same campaign, including CVE-2025-30208 and CVE-2024-45811. Of that cluster, only CVE-2025-31125 currently appears on the CISA Known Exploited Vulnerabilities catalog.
Patch and mitigation steps
Update Vite to 7.3.2, 8.0.5, or later without delay. More importantly, never expose a development server to the internet. Bind Vite to localhost and review Docker port mappings. Read the full F5 Labs analysis of the Vite scanning campaign for indicators. Finally, rotate any credentials that a reachable server may have exposed.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
