NPM · SEPTEMBER 2026 · EARLY WARNING

Vite Development Servers Targeted in Cloud Credential Theft Campaign

Q: Am I affected?

You may be affected if you are using a version of Vite less than 2.9.16 or greater than or equal to 3.0.2, less than 3.2.7 or greater than or equal to 4.0.0, and so on, as specified in the affected components list.

Q: What should I do right now?

Ensure your Vite development servers are not exposed to the internet and monitor for any suspicious activity related to AWS and Azure credentials.

Q: Has this been exploited in the wild?

Yes, the exploit for CVE-2026-39364 has been reportedly used in attacks targeting Vite development servers.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: vite (npm)
Affected versions: < 2.9.16 or >= 3.0.2, < 3.2.7 or >= 4.0.0, < 4.0.5 or >= 4.1.0, < 4.1.5 or >= 4.2.0, < 4.2.3 or >= 4.3.0, < 4.3.9 or >= 6.2.0, < 6.2.6 or >= 6.1.0, < 6.1.5 or >= 6.0.0, < 6.0.15 or >= 5.0.0, < 5.4.18 or < 4.5.13 or >= 6.2.0, < 6.2.4 or >= 6.1.0, < 6.1.3 or >= 6.0.0, < 6.0.13 or >= 5.0.0, < 5.4.16 or < 4.5.11 or >= 8.0.0, < 8.0.5 or >= 7.0.0, < 7.3.2 or < 6.4.2 or >= 5.4.0, < 5.4.6 or >= 5.3.0, < 5.3.6 or >= 5.2.0, < 5.2.14 or >= 4.0.0, < 4.5.4 or < 3.2.11 or >= 5.0.0, < 5.1.8 or >= 6.3.0, < 6.3.4 or >= 6.2.0, < 6.2.7 or >= 6.0.0, < 6.1.6 or >= 5.0.0, < 5.4.19 or < 4.5.14 or >= 2.7.0, < 2.9.18 or >= 3.0.0, < 3.2.10 or >= 4.0.0, < 4.5.3 or >= 5.0.0, < 5.0.13 or >= 5.1.0, < 5.1.7 or >= 5.2.0, < 5.2.6 or >= 4.4.0, < 4.4.12 or >= 4.5.0, < 4.5.1 or >= 4.5.0, <= 4.5.0 or >= 5.0.0, < 5.0.5 or >= 7.1.0, < 7.1.11 or >= 7.0.0, < 7.0.8 or >= 6.0.0, < 6.4.1 or >= 2.9.18, < 5.4.21 or >= 3.2.9, < 5.4.21 or >= 4.5.3, < 5.4.21 or >= 5.2.6, < 5.4.21 or >= 5.4.0, < 5.4.6 or >= 5.3.0, < 5.3.6 or >= 5.2.0, < 5.2.14 or >= 4.0.0, < 4.5.4 or < 3.2.11 or >= 5.0.0, < 5.1.8 or >= 2.7.0, < 2.9.17 or >= 3.0.0, < 3.2.8 or >= 4.0.0, < 4.5.2 or >= 5.0.0, < 5.0.12 or < 5.4.9 or >= 8.0.0, < 8.0.16 or >= 7.0.0, < 7.3.5 or < 6.4.3 or >= 7.1.0, < 7.1.5 or >= 7.0.0, < 7.0.7 or >= 6.0.0, < 6.3.6 or < 5.4.20 or >= 7.1.0, < 7.1.5 or >= 7.0.0, < 7.0.7 or >= 6.0.0, < 6.3.6 or < 5.4.20 or < 2.9.13 or >= 3.0.0-alpha.0, < 3.0.0-beta.4 or >= 8.0.0, < 8.0.5 or >= 7.0.0, < 7.3.2 or >= 6.0.0, < 6.4.2 or >= 8.0.0, < 8.0.5 or >= 7.1.0, < 7.3.2 or >= 8.0.0, < 8.0.16 or >= 7.0.0, < 7.3.5 or < 6.4.3 or >= 6.0.0, < 6.0.9 or >= 5.0.0, < 5.4.12 or < 4.5.6 or >= 6.2.0, < 6.2.3 or >= 6.1.0, < 6.1.2 or >= 6.0.0, < 6.0.12 or >= 5.0.0, < 5.4.15 or < 4.5.10 or >= 6.2.0, < 6.2.5 or >= 6.1.0, < 6.1.4 or >= 6.0.0, < 6.0.14 or >= 5.0.0, < 5.4.17 or < 4.5.12
Patched version: Not yet available

A mass-scanning campaign is reportedly targeting internet-exposed Vite development servers to steal cloud credentials and configurations from AWS and Azure deployments.

What happened

Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments to siphon sensitive data. The campaign, which leverages an exploit for CVE-2026-39364, aims at internet-exposed Vite development servers to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files. The exploit allows an unauthenticated attacker to bypass security restrictions via query parameter manipulation and leak sensitive data, including files specified by server.fs.deny.

The credential harvesting activity, observed in August 2026, requires three conditions to be met for an app to be deemed affected: the Vite dev server must be explicitly exposed to the network using --host or server.host config option, the sensitive file must exist in the allowed directories specified by server.fs.allow, and the sensitive file must be denied with a pattern that matches a file by server.fs.deny. Under default configurations, Vite binds to localhost. When developers expose the service by passing the --host flag, setting server.host, or misconfiguring Docker container ports, they may inadvertently expose sensitive files.

What to do about it

Ensure Vite development servers are not exposed to the internet.
Monitor for any suspicious activity related to AWS and Azure credentials.
Consult the primary sources for the most current information on affected versions and any available patches.
If using a version of Vite affected by CVE-2026-39364, consider upgrading to a non-vulnerable version if available.
No official fix has been published yet for all affected versions. Monitor the sources below for updates.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If vite is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using a version of Vite less than 2.9.16 or greater than or equal to 3.0.2, less than 3.2.7 or greater than or equal to 4.0.0, and so on, as specified in the affected components list.

What should I do right now?

Ensure your Vite development servers are not exposed to the internet and monitor for any suspicious activity related to AWS and Azure credentials.

Has this been exploited in the wild?

Yes, the exploit for CVE-2026-39364 has been reportedly used in attacks targeting Vite development servers.

Sources

Join the 0Day waitlist →

← Back to all threats