Vite development servers are being targeted in a large-scale automated scanning campaign aimed at stealing cloud credentials, environment variables, and Infrastructure-as-Code secrets. F5 recorded 807 session-grouped attacks and approximately 32,000 raw events during August 2026. The primary vulnerability exploited is CVE-2026-39364, while the same campaign also probed older Vite and Next.js vulnerabilities.
CVE-2026-39364 (CVSS 8.2 – High): A file-disclosure and access-control bypass vulnerability in Vite. Unauthenticated attackers can manipulate query parameters on the @fs endpoint, including ?raw, ?import&raw, and ?import&url&inline, to bypass server.fs.deny protections and retrieve restricted files. Potentially exposed information includes .env files, AWS credentials, Azure credentials, certificates, /proc/self/environ, Terraform state, API keys, and database credentials. Affected versions are Vite 7.1.0–7.3.1 and 8.0.0–8.0.4.[/subscribe_to_unlock_form]
Vite development servers are being targeted in a large-scale automated scanning campaign aimed at stealing cloud credentials, environment variables, and Infrastructure-as-Code secrets. F5 recorded 807 session-grouped attacks and approximately 32,000 raw events during August 2026. The primary vulnerability exploited is CVE-2026-39364, while the same campaign also probed older Vite and Next.js vulnerabilities.
CVE-2026-39364 (CVSS 8.2 – High): A file-disclosure and access-control bypass vulnerability in Vite. Unauthenticated attackers can manipulate query parameters on the @fs endpoint, including ?raw, ?import&raw, and ?import&url&inline, to bypass server.fs.deny protections and retrieve restricted files. Potentially exposed information includes .env files, AWS credentials, Azure credentials, certificates, /proc/self/environ, Terraform state, API keys, and database credentials. Affected versions are Vite 7.1.0–7.3.1 and 8.0.0–8.0.4.[emaillocker id="1283"]
CVE-2025-29927: A Next.js middleware authorization-bypass vulnerability observed being probed by the same scanning infrastructure. The campaign's activity indicates that attackers were targeting multiple web-development frameworks rather than relying exclusively on the Vite vulnerability.
CVE-2025-30208: A Vite file-access bypass vulnerability detected in the campaign's scanning activity. It was used as part of the broader exploit set targeting exposed Vite development servers.
CVE-2025-31125: A Vite file-access/access-control bypass vulnerability also targeted by the scanners.
CVE-2024-45811: A Vite-related file-access bypass vulnerability detected in the campaign. The article identifies it as another vulnerability involving file-access controls that attackers tested against exposed Vite servers.
We recommend you to update Vite to the 7.3.2 and 8.0.5. version.
The following reports contain further technical details:
[/emaillocker]