Frontend framework
Vite: latest release and open vulnerabilities today
The latest release of the vite package is 8.3.4. 4 high or critical advisories for the vite package were published in the last 12 months; one advisory (CVE-2025-31125) is on CISA’s list of vulnerabilities exploited in the wild.
Last checked against npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest vite release
- 8.3.4
- npm downloads last week
- 195.3M
- GitHub stars
- 83.3k
- Licence
- MIT
- OpenSSF Scorecard
- 6.8 / 10
Security advisories
7 advisories published in the last 12 months, 4 of them high or critical. 22 in total since records began. Checked packages: vite.
Older advisories CISA lists as exploited in the wild
- CVE-2025-31125 added ; fixed in 5.4.16, 6.0.13, 6.1.3 and 6.2.4.
vite: `server.fs.deny` bypass on Windows alternate paths
Fixed in 6.4.3, 7.3.5 and 8.0.16.
EPSS: top 54%launch-editor vulnerable to command injection via the crafted request on Windows
Fixed in 5.4.9.
EPSS: top 58%Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Fixed in 6.4.2, 7.3.2 and 8.0.5.
EPSS: top 15%Vite: `server.fs.deny` bypassed with queries
Fixed in 7.3.2 and 8.0.5.
EPSS: top 26%
Maintenance and supply chain
OpenSSF Scorecard 6.8 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 14 issue updates found in the last 90 days.
Weakest checks
- No fuzzing (Fuzzing 0/10)
- No OpenSSF best-practices badge (CII-Best-Practices 0/10)
- Binaries checked into the repo (Binary-Artifacts 1/10)
Docs and release notes
Check Vite in your own stack
This page checks Vite in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.