A large-scale scanning campaign has been targeting Vite development servers exposed to the internet, exploiting a file-read vulnerability (CVE-2026-39364) to harvest cloud credentials from AWS and Azure deployments. Vite is the build tool and development server used by millions of JavaScript projects; by default it binds to localhost and is never meant to face the public internet. But developers frequently expose it accidentally by passing the --host flag, setting server.host in their config, or through misconfigured Docker port mappings. When that happens, CVE-2026-39364 — disclosed in April — gives any unauthenticated attacker a trivial path to files that should be off-limits.
The vulnerability affects Vite versions 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5. The flaw lets an attacker append specific query parameters (?raw, ?import&raw, or ?import&url&inline) to an HTTP GET request, bypassing the server’s deny-list and retrieving arbitrary files in plaintext. Attackers used extensive wordlists to target .env files, AWS credential files, Azure configuration tokens, and other secrets stored on developer machines. F5 researchers, who detected the campaign through honeypot sensors, observed more than 800 attacks and roughly 32,000 raw events over a single month. Traffic originated mostly from US, Belgian, and Dutch IPs — all Google Cloud IP ranges — consistent with rented cloud infrastructure. The same actor group also probed for CVE-2025-30208 and CVE-2025-31125 (the latter already flagged as actively exploited).
How to check if you’re affected
Affected versions of Vite are 7.1.0 through 7.3.2, and 8.x builds before 8.0.5. Check your project’s package.json or run npx vite --version to confirm which version you’re using. If your Vite server has ever been accessible from outside localhost — via --host, server.host, or Docker port forwarding — assume any secrets in the server’s reach may have been collected and rotate them immediately: AWS access keys, Azure service principal credentials, API tokens in .env files. After rotating, update Vite to the latest patched version. As a precaution, block external access to port 5173 and block any requests containing /@fs/ at your firewall or reverse proxy.