# CVE-2026-112947: Vite information disclosure via WebAssembly query parameter

Source: https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112947 · Severity: medium · CVSS 4 · Published 2026-10-20

Vite is a frontend build tool for JavaScript applications. A flaw in its WebAssembly handling allows attackers to read the first 4 bytes of files outside the configured server directory by crafting specially formed requests. While the exposure is limited to just 4 bytes, this could reveal file signatures and headers that aid further attacks.

Technologies: [vite-plus (npm)](https://junglewise.ai/threats/technologies/vite-plus), [Vite](https://junglewise.ai/threats/technologies/vite), [Vite](https://junglewise.ai/threats/technologies/npm-vite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2026-112947 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112947 being exploited in the wild.

**How severe is CVE-2026-112947?** Medium severity, with a CVSS score of 4, published 20 October 2026.

**Which products and versions are affected?** vite-plus (npm) >= 0.2.8, <= 1.0.0, SEMVER:introduced=0.2.8,fixed=1.1.0; Vite 8.2.0 to 8.2.3, 8.3.0 to 8.3.2; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.

**Is there a fix for CVE-2026-112947?** Yes. vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112947 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112947?** Check whether you run vite-plus (npm), Vite or Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vite-plus (npm): upgrade to 1.1.0 or later

  ```sh
  npm install vite-plus@1.1.0
  ```

- Vite: upgrade to 8.3.3 or later

## Technical details

The Vite server's WebAssembly plugin load hook processes ?vite-wasm-instance query parameters without applying the fs.serve access controls. After reading the file from disk, failed WebAssembly parsing triggers an error message containing the first 4 bytes of the file. This affects versions 8.2.0–8.2.3 and 8.3.0–8.3.2, and is exploitable via network requests with no authentication required.

## Affected products

- Vite Vite 8.2.0 to 8.2.3, 8.3.0 to 8.3.2

## Identifiers

- CVE-2026-112947
- GHSA-vfpm-58rq-9qcg

## Timeline

- 2026-10-20: disclosed
- 2026-10-20: patched

## References

- [https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff](https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff)
- [https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73](https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vitest filesystem deny misapplication in dev servers](https://junglewise.ai/threats/cve-2026-112948-vitest-is-a-testing-framework-powered-by-vite-from-5-0-0-beta-6)
- [Vite import analysis filesystem disclosure](https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [launch-editor command injection in editor invocation](https://junglewise.ai/threats/cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in)