Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite-plus >= 0.2.8, <= 1.0.0 → 1.1.0

The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the [server.host](https://vite.dev/config/server-options#server-host) option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affe…

在 GitHub Advisory Database 阅读

2026/10/22 01:47，GitHub Advisory Database 发布了“Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js、Deno。CVE：CVE-2026-112947。