npm package
vite vulnerabilities by version
The latest release, 8.3.4 (Oct 8, 2026), has no known vulnerabilities. 32% of last week’s 195.3M downloads went to versions with known vulnerabilities. OSV.dev lists 22 advisories for vite; the newest was published on Jun 15, 2026.
npm (opens in a new tab) describes it as “Native-ESM powered web dev build tool”
- Latest release
- 8.3.4
- Oct 8, 2026, no known vulnerabilities
- Downloads last week
- 195.3M
- All versions, from npm
- Advisories on OSV.dev
- 22
- Newest Jun 15, 2026
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable vite
32% of last week’s 195.3M vite downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. vite doesn’t publish support dates we can check.
Newest advisories
The 5 most recently published, with the versions each one affects.
WarningCVE-2026-53632 on OSV.dev (opens in a new tab)GHSA-v6wh-96g9-6wx3
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
Affects >= 8.0.0, < 8.0.16; >= 7.0.0, < 7.3.5; < 6.4.3. Published Jun 15, 2026.
CriticalCVE-2026-53571 on OSV.dev (opens in a new tab)GHSA-fx2h-pf6j-xcff
vite: `server.fs.deny` bypass on Windows alternate paths
Affects >= 8.0.0, < 8.0.16; >= 7.0.0, < 7.3.5; < 6.4.3. Published Jun 15, 2026.
CriticalCVE-2024-52011 on OSV.dev (opens in a new tab)GHSA-c27g-q93r-2cwf
launch-editor vulnerable to command injection via the crafted request on Windows
Affects < 5.4.9. Published Jun 3, 2026.
WarningCVE-2026-39365 on OSV.dev (opens in a new tab)GHSA-4w7w-66w2-5vf9
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
Affects >= 8.0.0, < 8.0.5; >= 7.0.0, < 7.3.2; < 6.4.2. Published Apr 6, 2026.
CriticalCVE-2026-39364 on OSV.dev (opens in a new tab)GHSA-v2wj-q39q-566r
Vite: `server.fs.deny` bypassed with queries
Affects >= 8.0.0, < 8.0.5; >= 7.1.0, < 7.3.2. Published Apr 6, 2026.
All 22 advisories are on OSV.dev (opens in a new tab).
Which vite do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for vite, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.