Skip to main content

Incorrect Behavior Order: Validate Before Canonicalize

CVE-2026-39364

High
8.2/10

Summary

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.0 prior to 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

The software validates input before it is canonicalized, which prevents the software from detecting data that becomes invalid after the canonicalization step.

References

Advisory Timeline

  • Published