CVE-2026-112947: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Summary
The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance.
Impact
Only apps that match one of the following conditions are affected:
- explicitly expose the Vite dev server to the network using --host or the server.host option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affected)
Details Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied.
After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file.
PoC
Create a denied file and start an affected Vite dev server:
bash echo 'SECRETKEY=abc123\n' > .env npm run dev curl 'http://localhost:5173/.env?vite-wasm-instance'
This will show Failed to parse WASM file "<root>/.env": WebAssembly.compile(): expected magic word 00 61 73 6d, found 53 45 43 52 @+0
Other sources
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.3.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/vite-plusto a version that resolves this vulnerability.Fixed in 1.1.0 - Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 8.2.4 - Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 8.3.3 - Upgrade
Upgrade
Viteto a version that resolves this vulnerability.Fixed in 8.2.4Patch 8.3.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Vite versions from 8.2.0 through 8.2.4 and version 8.3.3 are identified as affected. The issue applies when the Vite server can be reached by an attacker, because exploitation uses a network request and requires no privileges or user interaction.
What does an attacker need to do to exploit this?
An attacker sends a request containing the ?vite-wasm-instance query and a path to a file outside the configured server.fs boundary. The internal Wasm plugin reads that path without applying server.fs checks; a failed WebAssembly parse can disclose the file's first four bytes in the error.
Is a restrictive server.fs configuration sufficient mitigation?
No. The vulnerable Wasm-plugin load path bypasses server.fs checks, so files outside that configured boundary may still have their first four bytes exposed through the affected query handling.
What should be done if the server cannot be patched immediately?
Limit access to the Vite server so untrusted users cannot send requests to it, particularly requests containing ?vite-wasm-instance. Upgrade to a fixed release when possible; the issue is fixed in 8.2.4 and 8.3.3.