{"id":"ghsa-ghsa-vfpm-58rq-9qcg","seq":32745,"kind":"advisory","title":"Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`","url":"https://github.com/advisories/GHSA-vfpm-58rq-9qcg","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vfpm-58rq-9qcg","summary":"影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite-plus >= 0.2.8, <= 1.0.0 → 1.1.0\nSummary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the [server.host](https://vite.dev/config/server-options#server-host) option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affe…","severity":"medium","techs":["nodejs","deno"],"cves":["CVE-2026-112947"],"tags":["GHSA-vfpm-58rq-9qcg","vite","vite","vite-plus"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T16:47:15.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}