## Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs, deno
- CVE: CVE-2026-112947
- 公開日時: 2026-10-21T16:47:15.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-vfpm-58rq-9qcg)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-vfpm-58rq-9qcg

影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite-plus >= 0.2.8, <= 1.0.0 → 1.1.0
Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the [server.host](https://vite.dev/config/server-options#server-host) option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affe…