Vite — one of the most widely used tools for building modern JavaScript web apps — has a file-disclosure flaw, tracked as CVE-2026-39364, that lets an attacker with no login read files the dev server was supposed to block. By appending parameters such as ?raw or ?import&raw to a request, an unauthenticated visitor can pull back .env files, certificates, and other local project files in plaintext. The flaw affects Vite versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4; fixed versions 7.3.2 and 8.0.5 have been available since April 2026.
Security firm F5 says its honeypot sensors picked up more than 800 attacks and roughly 32,000 scanning events over the past month, with attackers specifically hunting for AWS credentials, Azure access tokens, and Terraform configuration files — exactly the kind of secrets a developer's local .env file tends to hold. Most of the scanning traffic traced back to cloud infrastructure in the US, Belgium, and the Netherlands. A dev server is meant to run only on a developer's own machine; the servers getting hit are ones that were, deliberately or by accident, reachable from the open internet.
What this means for your business
If your website or app was built with modern JavaScript tooling, ask whoever builds or maintains it — an in-house developer or an outsourced team — two direct questions: are we running Vite, and has a dev server for this project ever been exposed outside the office network (a cloud VM used for a demo, a misconfigured firewall rule, a shared test environment)? If the answer isn't a confident "no," have them update to Vite 7.3.2, 8.0.5, or newer today, and treat any AWS keys, Azure tokens, or Terraform state on that machine as potentially seen by an outsider — rotate them rather than assume the best. This costs an afternoon to check and far more to clean up after the fact.