Incorrect Behavior Order: Validate Before Canonicalize Affecting vite package, versions >=7.1.0 <7.3.2>=8.0.0 <8.0.5
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-VITE-15922245
- published7 Apr 2026
- disclosed6 Apr 2026
- creditodgrso, Ritik Chaddha, neo-ai-engineer, instantraaamen, fg0x0, jonathanwd, kq5y
Introduced: 6 Apr 2026
NewCVE-2026-39364 (opens in a new tab)How to fix?
Upgrade vite to version 7.3.2, 8.0.5 or higher.
Overview
vite is a Native-ESM powered web dev build tool
Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through the server.fs.deny component. An attacker can access sensitive files by appending specific query parameters such as ?raw, ?import&raw, or ?import&url&inline to HTTP requests.
Note:
This is only exploitable if the development server is explicitly exposed to the network, the sensitive file exists within directories allowed by server.fs.allow, and the file is denied by a pattern in server.fs.deny.