Frontend Secrets Exposed: Vite Patches Critical Security Bypass in Dev Server

Vite dev servers are affected by two critical vulnerabilities (CVE-2026-39364 and CVE-2026-39363) that let an attacker read sensitive files: one bypasses server.fs.deny via crafted query parameters to retrieve files like .env, and the other abuses the HMR WebSocket fetchModule path to read arbitrary file:// paths. The report lists affected 6.x–8.x Vite releases and Vite-Plus, describes exposure conditions (network-hosted dev servers and active WebSockets), and urges immediate upgrades to the provided patched versions.