Vite patches CVE-2026-39363 (arbitrary file read via dev server WebSocket) and CVE-2026-39364 (server.fs.deny bypass), affecting versions 6.x, 7.x, and 8.x. Fixed in 6.4.2, 7.3.2, and 8.0.5.
Send crafted vite:invoke events with file:// URIs and ?raw or ?inline query parameters over a dev server's WebSocket, and you can read arbitrary files off the host machine: that's CVE-2026-39363 (CVSS 7.5, CVSS 4.0 8.2), one of two high-severity vulnerabilities Vite patched this week across the 6.x, 7.x, and 8.x release lines. The attack bypasses server.fs.allow restrictions entirely through the WebSocket path, requiring no authentication.
CVE-2026-39364 (CVSS 7.5, CVSS 4.0 8.2) bypasses server.fs.deny when query parameters like ?raw, ?import&raw, or ?import&url&inline hit restricted files such as .env and *.crt certificates. CVE-2026-39363 affects 6.0.0 through 6.4.1, 7.0.0 through 7.3.1, and 8.0.0 through 8.0.4; CVE-2026-39364 affects 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 (the 6.x line is unaffected). Patches ship in 6.4.2, 7.3.2, and 8.0.5.
Both vulnerabilities require the dev server to be network-accessible, but don't count on that for protection: Vite's dev WebSocket has no Origin header check by default, so any client that reaches the port can fire malicious messages. If you expose Vite dev servers via --host for mobile testing or run them in shared Docker environments, upgrade now. These CVEs only affect the dev server, not production builds.
Next.js shipped its first pre-announced monthly security release on July 20, patching 9 vulnerabilities (4 high severity) across v16.2.11 and v15.5.21.
1 source
CVE-2026-85625 covers sift through 17.1.3 with no patched release: a prototype-pollution path plus default `$where` compilation turns a benign `sift({})` call into arbitrary code execution.
3 sources
CVE-2026-44907 (CVSS 7.5) allows unauthenticated remote attackers to trigger CPU exhaustion and OOM conditions via crafted HTTP requests to Server Function endpoints.
2 sources