CVE-2026-112945

Awaiting Analysis Awaiting Analysis - Queue

Server-Side Request Forgery in Vite Development Server

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112945

EUVD

EUVD-2026-105125

Affected Vendors & Products

Vendor	Product	Version / Range
vitejs	vite	>= 8.3.0, < 8.3.3
vitejs	vite	>= 8.2.0, < 8.2.4
vitejs	vite	>= 8.0.0, < 8.1.6
vitejs	vite	>= 7.0.0, < 7.3.7
vitejs	vite	< 6.4.4
vitejs	vite-plus	< 1.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

CVE-2026-112945 is a vulnerability in Vite, a JavaScript build tool, that allows cross-origin script execution through custom middleware. The issue affects specific Vite configurations where the dev server passes an unchanged browser request URL to server.transformIndexHtml. An attacker can craft a malicious URL that tricks the server into loading and executing a script from an external domain, potentially enabling cross-site scripting (XSS) attacks.

Detection Guidance

Check your Vite version with 'npm list vite' or 'yarn list vite'. If using versions before 6.4.4, 7.3.7, 8.1.6, 8.2.4, or 8.3.3, the system is vulnerable. Inspect server configurations for middlewareMode: true or appType: 'custom'.

Impact Analysis

If exploited, this vulnerability could expose sensitive page data or permit critical actions available to the affected application. It requires user interaction and specific vulnerable configurations, such as using server.middlewareMode: true or appType: 'custom'. The impact is limited due to its low CVSS score of 2.1.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling cross-site scripting (XSS) attacks. If exploited, it may allow unauthorized access to sensitive data processed by the application, violating confidentiality requirements under these regulations. The attack requires user interaction and specific vulnerable configurations.

Mitigation Strategies

Upgrade Vite to versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, or 8.3.3 or later. Review server middleware configurations to avoid passing unchanged browser URLs to transformIndexHtml.

Hi! I’m here to help you understand CVE-2026-112945. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...