`vite`

Ecosystem:
npm

Package URL:
pkg:npm/vite

Total PRs:
106,988 Dependabot PRs

Latest PR:
about 3 hours ago

Unique Repositories:
41,432 repositories

Unique Repos (30 days):
1,119 repositories

Security Advisories

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

GHSA-353f-5xf4-qw67 CVE-2023-34092 HIGH published almost 3 years ago • updated 4 days ago

The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash (`//`). This vulnerabilit...

Vite middleware may serve files starting with the same name with the public directory

GHSA-g4jq-h2w9-997c CVE-2025-58751 LOW published 6 months ago • updated 15 days ago

### Summary Files starting with the same name with the public directory were served bypassing the `server.fs` settings. ### Impact Only apps that ...

Vite's server.fs.deny bypassed with /. for files under project root

GHSA-859w-5945-r5v3 CVE-2025-46565 MODERATE published 10 months ago • updated 13 days ago

### Summary The contents of files in [the project `root`](https://vite.dev/config/shared-options.html#root) that are denied by a file matching patt...

Vite has an `server.fs.deny` bypass with an invalid `request-target`

GHSA-356w-63v5-8wf4 CVE-2025-32395 MODERATE published 11 months ago • updated 7 days ago

### Summary The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. ### Impact Only apps with ...

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

GHSA-mv48-hcvh-8jj8 CVE-2022-35204 HIGH published over 3 years ago • updated 27 days ago

Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.

View all 16 advisories

Recent PRs

RSS Feed

Bump vite from 6.4.1 to 7.3.1

hermes-hq/hermes-ide #66

6.4.1 → 7.3.1 Major PR

Open about 3 hours ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 21 updates

JounQin/renovate #12

6.3.5 → 6.4.1 Minor PR

Open about 4 hours ago 3 comments

Bump vite from 6.1.0 to 7.3.1 in /js

code-review-benchmark/keycloak__keycloak__vercel__PR36880__20260310 #37

6.1.0 → 7.3.1 Major PR

Open about 6 hours ago 1 comment

Bump vite from 6.3.5 to 6.4.1 in the npm_and_yarn group across 1 directory

Wasel-14/Wasselridesharing14 #1

6.3.5 → 6.4.1 Minor PR

Closed about 6 hours ago 2 comments

chore(deps-dev): bump vite from 5.4.21 to 7.3.1

mickosana/dura #5

5.4.21 → 7.3.1 Major PR

Closed about 7 hours ago 2 comments

build(deps-dev): bump the npm_and_yarn group across 2 directories with 2 updates

Dargon789/thirdweb-dev #661

7.1.7 → 7.1.11 Patch PR

Open about 13 hours ago 1 comment

Bump the dev-dependencies group across 1 directory with 20 updates

journium/journium-js #69

5.4.21 → 7.3.1 Major PR

Open about 14 hours ago 1 comment

chore(deps): bump esbuild and vite

Chiammu/Expense-Tracker #26

5.4.21 → 7.3.1 Major PR

Open about 14 hours ago 3 comments

Bump vite from 6.1.0 to 7.3.1 in /js

code-review-benchmark/keycloak__keycloak__bito__PR37429__20260310 #53

6.1.0 → 7.3.1 Major PR

Open about 15 hours ago 1 comment

build(deps): Bump the npm_and_yarn group across 1 directory with 9 updates

OsoPanda1/citemesh-roots #2

5.4.19 → 5.4.21 Patch PR

Open about 15 hours ago 1 comment

Bump vite from 6.0.11 to 7.3.1 in /js

code-review-benchmark/keycloak__keycloak__bito__PR36882__20260310 #12

6.0.11 → 7.3.1 Major PR

Open about 16 hours ago 1 comment

Bump vite from 6.2.3 to 7.3.1 in /js

code-review-benchmark/keycloak__keycloak__sentry__PR38446__20260310 #52

6.2.3 → 7.3.1 Major PR

Open about 16 hours ago 1 comment

Bump vite from 6.1.0 to 7.3.1 in /js

code-review-benchmark/keycloak__keycloak__sentry__PR37038__20260309 #45

6.1.0 → 7.3.1 Major PR

Open about 16 hours ago 1 comment

Bump vite from 8.0.0-beta.16 to 8.0.0-beta.18

Gobd/dak #180

8.0.0-beta.16 → 8.0.0-beta.18

Open about 17 hours ago 1 comment

Bump vite from 7.0.5 to 7.3.1 in /js

code-review-benchmark/keycloak__keycloak-greptile__korbit__PR1__20260309 #45

7.0.5 → 7.3.1 Minor PR

Open about 17 hours ago 1 comment

build(deps-dev): bump vite from 4.5.14 to 7.3.1

Krugou/elementdemo #3

4.5.14 → 7.3.1 Major PR

Closed about 19 hours ago 1 comment

chore(deps-dev): bump the development-dependencies group across 1 directory with 8 updates

byldpartners/byld.ui #4

6.4.1 → 7.3.1 Major PR

Closed about 19 hours ago 1 comment