Vite dev server on a live site

If your live site is the Vite dev server instead of a production build, anyone can load your source files, and older Vite versions have known bugs that let anyone read files like .env. Attackers scan for this at scale.

Threat brief · updated Oct 22, 2026

What it is: a public site served by vite or npm run dev, the development server meant for your own machine, instead of the built dist/ folder.

Who's affected: Vite-based apps, including Lovable apps (Vite/React), deployed by running the dev command on a VPS, container or preview host, often with --host so it listens publicly.

Why now: F5 Labs' sensors recorded a sustained scanning operation against exposed Vite dev servers in August 2026, about 807 session-grouped attacks and roughly 32,000 events in the month, cycling through wordlists of environment files, cloud keys and infrastructure state files (F5 Labs, Sep 11, 2026).

The advisories

Each is fixed in different versions:

GHSA-v2wj-q39q-566r (CVE-2026-39364), "server.fs.deny bypassed with queries": affects 7.1.0 to 7.3.1 and 8.0.0 to 8.0.4; fixed in 8.0.5 and 7.3.2.
GHSA-fx2h-pf6j-xcff (CVE-2026-53571), "server.fs.deny bypass on Windows alternate paths": affects 6.4.2 and earlier, 7.0.0 to 7.3.4 and 8.0.0 to 8.0.15; fixed in 8.0.16, 7.3.5 and 6.4.3.

Upgrading to 8.0.16, 7.3.5 or 6.4.3 or later covers both. Both are dev-server bugs: a production build served from dist/ isn't affected.

Safe self-check

Run these against your own site. They read your page and the dev client script, nothing else.

Terminal

curl -s https://your-app.com/ | grep -o 'src="/@vite/client"'
curl -s https://your-app.com/@vite/client | grep -c "\[vite\] connecting"

If the first prints the tag and the second prints a number above 0, your live site is the dev server. A production build has neither. Or use the free checker: Did I ship a dev server?

Check your live site

The scan only looks for the dev server from what any browser loads. It doesn't read your Vite version and never tries the file-read bugs.

Uses 1 of your 3 free scans today; a site scanned in the last 24 hours answers from that scan. Passive and read-only: we only look at what any browser can see. Only check sites you own or may test.

The fix

Change the deploy to run vite build and serve the built dist/ folder from a normal host (Vercel, Netlify, Cloudflare Pages, or any static server).
Never run vite or vite --host on a public port.
Upgrade Vite to 8.0.16, 7.3.5 or 6.4.3 or later.
If the dev server was public, rotate the keys in your .env.

Copy-paste into your AI builder

My live site is running the Vite dev server (vite / npm run dev). Change the deploy so it runs vite build and serves the built dist/ folder from a normal host. Never run vite dev or vite --host on a public port. Also update Vite to 8.0.16, 7.3.5 or 6.4.3 or later.

Questions

How do attackers find exposed Vite dev servers?

By scanning the internet for the dev server's responses and then requesting files from it. F5 Labs recorded a sustained campaign doing this in August 2026, cycling through lists of env files and cloud credentials.

Is a Vite production build affected by CVE-2026-39364?

No. The advisories are about the dev server. A site built with vite build and served from the dist folder doesn't run the dev server, so these bugs don't apply.

Do I still need to upgrade Vite if I serve a production build?

Yes, it's still worth it: you or your team may run the dev server on a shared network or preview host. 8.0.16, 7.3.5 or 6.4.3 or later covers both advisories.

More threats: all threat briefs · everything ShipLatch checks