Vite dev server CVE-2026-39364 (server.fs.deny bypass with query strings, GHSA-v2wj-q39q-566r) is being actively exploited to steal .env files and cloud keys from exposed dev servers. Which versions fix it and how do I stop exposing the dev server?

What it is: Vite's dev server blocks sensitive files (.env, certificates, keys) through the server.fs.deny list. CVE-2026-39364 (published April 2026) let a request with certain query strings get those files anyway. A related flaw, CVE-2026-39363 (GHSA-p9ff-h696-f583), allowed reading files through the dev server's WebSocket without authentication. Singapore's Cyber Security Agency warned on September 17, 2026 that CVE-2026-39364 is being actively exploited, and researchers have tracked mass scanning of exposed Vite dev servers to harvest AWS and Azure credentials from .env files. The dev server is only meant for local development, but it often ends up reachable: --host in package.json scripts, cloud dev boxes, preview environments, and containers publishing port 5173. Am I affected: - vite 7.1.0-7.3.1 or 8.0.0-8.0.4 (CVE-2026-39364); also 6.0.0-6.4.1, 7.0.x and 8.0.0-8.0.4 for the WebSocket file read (CVE-2026-39363). vite-plus 0.1.15 and earlier per CSA. - Real exposure requires the dev server (vite, vite dev, npm run dev) to be reachable from other machines: started with --host or server.host: true / '0.0.0.0', or running in a container or cloud VM with the port open. - Check with npm ls vite and look for --host in your scripts and server.host in vite.config. Fix: 1. Upgrade vite to 8.0.5+, 7.3.2+ or 6.4.2+ (latest on your major is best), including in templates and scaffolding your team copies. 2. Never expose the dev server to the internet. Remove --host unless needed; when you need LAN or container access, restrict it with a firewall or VPN and bind to a specific interface. Use vite build plus a real web server (or vite preview behind access control) for anything shared. 3. Keep secrets out of the project folder where possible; .env files read by the dev server should hold only development values. 4. If a dev server on an affected version was reachable from the internet, assume files in the project were read: rotate every key in .env files and nearby credentials (cloud keys, API tokens, database passwords), and check cloud audit logs for their use. Verify: npm ls vite shows a fixed version, and from outside your network the dev port does not answer. Sources: https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583 https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-124/ https://labs.cloudsecurityalliance.org/research/csa-research-note-vite-dev-server-credential-harvesting-2026/