Mass-Scanning Campaign Exploits Vite CVE-2026-39364 to Steal AWS and Azure Cloud Credentials from Exposed Dev Servers

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2025-29927 is a critical (CVSS 9.1) authorization bypass in Vercel's Next.js, a widely used React framework for full-stack web applications: when an application performs its authorization checks in middleware, a remote unauthenticated attacker can bypass those checks by sending a request containing the x-middleware-subrequest header, which causes the middleware to be skipped. Successful exploitation grants access to otherwise protected routes and resources without valid credentials, with high impact on confidentiality and integrity and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). All Next.js releases starting in version 1.11.4 and prior to the branch-specific fixed versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3 are affected, so any Next.js application that relies on middleware for authorization is exposed. Exploitation is not yet confirmed in the provided data: the flaw is not in CISA KEV and no public proof-of-concept is catalogued, but EPSS assigns a 99.2% (100th percentile) probability of exploitation within 30 days, and national authorities such as the UK NCSC are urging immediate patching.

Do: Upgrade Next.js to 12.3.5, 13.5.9, 14.2.25, or 15.2.3, matching your application's release branch. If patching is infeasible, block or strip the x-middleware-subrequest header from external requests at the reverse proxy, CDN, or WAF before they reach the Next.js application. Audit whether your applications perform authorization checks in middleware, and verify that protected routes cannot be reached without authentication after remediation.

Vite dev servers in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fail to enforce the `@fs` file-access allow list because trailing separators such as `?` are stripped in several places but are not accounted for in the query-string regexes. A remote, unauthenticated attacker triggers the flaw by appending `?raw??` or `?import&raw??` to a dev-server URL, bypassing the restriction and returning the contents of arbitrary files on the host if they exist. The impact is confidentiality only — arbitrary file read with no code execution or privilege escalation, consistent with the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Only projects that explicitly expose the Vite dev server to the network (via `--host` or the `server.host` config option) are affected; purely local development usage is not remotely exploitable. A public proof of concept is available in the GitHub advisory (GHSA-x574-m823-4x7w); the flaw is not yet in CISA KEV, but EPSS assigns a 75% probability of exploitation within 30 days (99th percentile), so opportunistic scanning is likely.

Do: Upgrade Vite to 6.2.3, 6.1.2, 6.0.12, 5.4.15, or 4.5.10 depending on your release branch. If you cannot upgrade immediately, stop exposing the dev server to untrusted networks (remove `--host` / set `server.host` to localhost) or firewall the dev-server port. Audit internet-facing hosts for running Vite dev servers and check access logs for requests containing `?raw??` or `?import&raw??`, which may indicate exploitation attempts.

CVE-2025-31125 is an improper access control flaw (CWE-284/CWE-200) in the Vite JavaScript frontend tooling's dev server, where HTTP requests using the '?inline&import' or '?raw?import' query parameters can read the contents of files the dev server should not serve, bypassing its file-access restrictions (server.fs.deny). An unauthenticated remote attacker (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) triggers it by sending crafted requests with these query parameters to a running Vite dev server. The attacker gains read access to arbitrary files on the machine running the dev server, such as source code and .env files containing secrets, with high confidentiality impact and no integrity or availability impact. Only applications that explicitly expose the Vite dev server to the network via the --host flag or the server.host option are affected; production builds are not impacted. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22 (ransomware association unknown), and EPSS assigns a 58.5% probability of exploitation within 30 days (99th percentile).

Do: Upgrade Vite to 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11 depending on your release line. Until patched, do not expose the dev server to untrusted networks (remove --host/server.host or bind to localhost behind an access-controlled proxy), and review access logs for requests using ?inline&import or ?raw?import that retrieved sensitive files such as .env. As a KEV entry added 2026-01-22, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use if mitigations are unavailable.

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.