vite

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

• Fixed in 8.0.16 · 2 advisories

  • HIGHvite: `server.fs.deny` bypass on Windows alternate pathsGHSA-fx2h-pf6j-xcff
  • MODERATElaunch-editor: NTLMv2 hash disclosure via UNC path handling on WindowsGHSA-v6wh-96g9-6wx3

• Fixed in 8.0.5 · 3 advisories

  • HIGHVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocketGHSA-p9ff-h696-f583
  • HIGHVite: `server.fs.deny` bypassed with queriesGHSA-v2wj-q39q-566r
  • MODERATEVite Vulnerable to Path Traversal in Optimized Deps `.map` HandlingGHSA-4w7w-66w2-5vf9

• Fixed in 7.1.11 · 1 advisory

  • MODERATEvite allows server.fs.deny bypass via backslash on WindowsGHSA-93m4-6634-74q7

• Fixed in 7.1.5 · 2 advisories

  • LOWVite middleware may serve files starting with the same name with the public directoryGHSA-g4jq-h2w9-997c
  • LOWVite's `server.fs` settings were not applied to HTML filesGHSA-jqfw-vq24-v9c3

Every stable release, newest first. Notes are quoted as the maintainers published them.

1. 8.3.4

   8 October 2026
   bundled-dev: support import.meta.hot.acceptExports

   Features

   • bundled-dev: support import.meta.hot.acceptExports

   Bug Fixes

   • avoid mutating hmr defaults (fix #23575)

   • build: correct preloads when chunkImportMap is enabled with non-root base

   • build: wait for in-flight stylesheets in preload helper (fix #23652)

   • bundled-dev: serve /@vite/client and stub @vite/env

   • client: skip rewriting unchanged adopted styles

   • css: resolve imported preprocessors from their file path with lightningcss

   • deps: update all non-major dependencies

   • deps: update rolldown-related dependencies

   • dev: a restart requested during a restart used to be dropped (fix #23392)

   • don't treat modules ending with js-like query as js

   • html: avoid adding filesystem root to watcher

   • html: skip caching CSS of chunks in a cycle (fix #23628)

   • optimizer: scan deep imports with custom extensions

   • remove input option unescaping for now

   • server: match static aliases on path boundaries

   • watcher: normalize file before root check in ensureWatchedFile

   Performance Improvements

   • module-runner: skip cloning call sites that have no source map

2. 6.4.4

   6 October 2026
   Please refer to CHANGELOG.md for details.

   Please refer to CHANGELOG.md for details.

3. 7.3.7

   6 October 2026
   Please refer to CHANGELOG.md for details.

   Please refer to CHANGELOG.md for details.

4. 8.1.6

   6 October 2026
   Please refer to CHANGELOG.md for details.

   Please refer to CHANGELOG.md for details.

5. 8.2.4

   6 October 2026
   Please refer to CHANGELOG.md for details.

   Please refer to CHANGELOG.md for details.

6. 8.3.3

   6 October 2026
   Update launch-editor to v2.14.2

   Bug Fixes

   • deps: update launch-editor to v2.14.2

   • html: filename passed to transformIndexHtml should not include queries

   • server: check fs.serve for ?vite-wasm-instance

   • server: store ids to safeModulePaths rather than URLs

7. 8.3.2

   1 October 2026
   Preload CSS correctly when renderBuiltUrl returns URLs with queries

   Bug Fixes

   • build: preload CSS correctly when renderBuiltUrl returns URLs with queries

   • bundled-dev: serve lazy chunk sourcemaps

   • bundled-dev: serve the rolldown runtime from the installed rolldown

   • deps: update all non-major dependencies

   • deps: update rolldown-related dependencies

   • html: resolve percent-encoded srcset urls

   • limit size of object and array printing via forwardConsole

   • merge build.rolldownOptions.output.minify correctly

   • optimize-deps: avoid "unsupported" warnings for browser:false mappings

   • optimizer: preserve excluded optional peer require fallbacks

   • pass queries to renderBuiltUrl

   • server: handle file watcher errors without crashing

   • server: release previous environments after initialization

   • ssr: encode whitespace in module runner sourceURL

   • worker: align worker urls in client and server when using terser

   Performance Improvements

   • avoid encoding intermediate source maps

   • build: avoid quadratic link scan in the preload helper

   • only register time middleware when debug logging is enabled

8. 8.3.1

   24 September 2026
   Update all non-major dependencies

   Bug Fixes

   • deps: update all non-major dependencies

   • deps: update all non-major dependencies

   • deps: update rolldown-related dependencies

   • handle server.ws: false in mergeConfig

   • merge build.rolldownOptions.output.comments correctly

   • optimizer: don't skip imports whose binding starts with type

   • optimizer: resolve pending discovered dep processing on close before init

   • server: avoid reinitializing watcher when adding file after server close

   • sourcemap: skip URL source roots when injecting sources content

9. 8.3.0

   10 September 2026
   Avoid settling seen preload dependencies for performance

   Features

   • build: avoid settling seen preload dependencies for performance

   Bug Fixes

   • handle CRLF line endings in code frame positions

   • only treat whole node_modules path segments as dependencies (fix #17467)

   Performance Improvements

   • proxy: pre-compile context matchers at server creation

10. 8.2.2

    20 August 2026
    Please refer to CHANGELOG.md for details.

    Please refer to CHANGELOG.md for details.

Major versions

• 8.xsince 12 March 2026 · latest 8.3.4 · 33 releases
• 7.xsince 24 June 2025 · latest 7.3.7 · 36 releases
• 6.xsince 26 November 2024 · latest 6.4.4 · 44 releases
• 5.xsince 16 November 2023 · latest 5.4.21 · 67 releases
• 4.xsince 9 December 2022 · latest 4.5.14 · 53 releases
• 3.xsince 13 July 2022 · latest 3.2.11 · 30 releases
• 2.xsince 16 February 2021 · latest 2.9.18 · 97 releases
• 0.xsince 21 April 2020 · latest 0.20.10 · 78 releases