{ "@id": "urn:uuid:f7184f2b-f388-4014-ae90-d1f4ff6436e6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 19, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:37:46.215147+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 6.4.3 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 6.4.3 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 6.4.3 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 6.4.3 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-03T23:47:44.058977+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 6.4.3 of vite. not_affected \u2014 The target repository Vite v6.4.3-tuxcare.2 is NOT affected by CVE-2024-31207. The vulnerability (fs.deny bypass via matchBase:true picomatch configuration) was fixed in upstream Vite and the fix was already present in the v6.4.3 release that TuxCare onboarded. The fix is located in packages/vite/src/node/config.ts lines 1553-1565, implementing the correct picomatch configuration with matchBase...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 The target repository Vite v6.4.3-tuxcare.2 is NOT affected by CVE-2024-31207. The vulnerability (fs.deny bypass via matchBase:true picomatch configuration) was fixed in upstream Vite and the fix was already present in the v6.4.3 release that TuxCare onboarded. The fix is located in packages/vite/src/node/config.ts lines 1553-1565, implementing the correct picomatch configuration with matchBase..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-03T23:52:00.070015+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 6.4.3 of vite. not_affected \u2014 The target repository (Vite 6.4.3-tuxcare.2) is not affected by CVE-2024-45811. The vulnerability, which allowed bypassing @fs access controls via ?import&raw query parameters to read arbitrary files, was fixed in upstream commit 9d2413c8b (Sept 16, 2024) by patak-dev. This fix was already present in the upstream v6.4.3 release that TuxCare onboarded. The current code includes deniedServingAcce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 The target repository (Vite 6.4.3-tuxcare.2) is not affected by CVE-2024-45811. The vulnerability, which allowed bypassing @fs access controls via ?import&raw query parameters to read arbitrary files, was fixed in upstream commit 9d2413c8b (Sept 16, 2024) by patak-dev. This fix was already present in the upstream v6.4.3 release that TuxCare onboarded. The current code includes deniedServingAcce..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 6.4.3 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 6.4.3 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-03T23:55:47.274046+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 6.4.3 of vite. not_affected \u2014 Target version 6.4.3-tuxcare.2 is not affected by CVE-2025-24010. All three vulnerability patterns described in the CVE have been fixed in the upstream Vite v6.4.3 release that TuxCare onboarded. The fixes include: (1) WebSocket token validation to prevent CSWSH attacks, (2) CORS default changed from permissive (*) to loopback-only origins (localhost/127.0.0.1/[::1]), and (3) Host header valida...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Target version 6.4.3-tuxcare.2 is not affected by CVE-2025-24010. All three vulnerability patterns described in the CVE have been fixed in the upstream Vite v6.4.3 release that TuxCare onboarded. The fixes include: (1) WebSocket token validation to prevent CSWSH attacks, (2) CORS default changed from permissive (*) to loopback-only origins (localhost/127.0.0.1/[::1]), and (3) Host header valida..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-06T11:24:00.494767+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 6.4.3 of vite. not_affected \u2014 The upstream fix for CVE-2025-30208 (vite commit 262b5ec7a, \"fix: fs raw query with query separators (#19702)\") is already in the target. It was authored upstream by green@sapphi.red and shipped in the release TuxCare onboarded, before the first TuxCare commit. The vulnerable pattern is therefore not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-30208 (vite commit 262b5ec7a, \"fix: fs raw query with query separators (#19702)\") is already in the target. It was authored upstream by green@sapphi.red and shipped in the release TuxCare onboarded, before the first TuxCare commit. The vulnerable pattern is therefore not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-06T11:28:33.386441+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 6.4.3 of vite. not_affected \u2014 Vite 6.4.3 already contains the upstream fix for CVE-2025-31125. The transform middleware runs the fs.allow/deny serving-access check on any request URL with ?raw, ?url or ?inline (also after `&`), before the ?import query is stripped. The fix commit was authored upstream and shipped in the release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 6.4.3 already contains the upstream fix for CVE-2025-31125. The transform middleware runs the fs.allow/deny serving-access check on any request URL with ?raw, ?url or ?inline (also after `&`), before the ?import query is stripped. The fix commit was authored upstream and shipped in the release TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-06T11:35:23.213084+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 6.4.3 of vite. not_affected \u2014 Vite 6.4.3-tuxcare.2 already contains the upstream fix for CVE-2025-31486 (upstream commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\"). That commit shipped in the upstream v6.4.3 release, before the first TuxCare commit. The fs allow/deny check now runs on the normalized id at load time, and the `.svg` and `?raw`/`?url`/`?inline` bypasses are closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 6.4.3-tuxcare.2 already contains the upstream fix for CVE-2025-31486 (upstream commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\"). That commit shipped in the upstream v6.4.3 release, before the first TuxCare commit. The fs allow/deny check now runs on the normalized id at load time, and the `.svg` and `?raw`/`?url`/`?inline` bypasses are closed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-06T11:37:46.215147+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 6.4.3 of vite. not_affected \u2014 The upstream fix for CVE-2025-32395 (commit 175a83909f, \"reject requests with # in request-target\") is already in this tree. It shipped in the upstream vite 6.4.3 release that TuxCare onboarded. The dev server rejects any request whose req.url contains '#' with a 400 before the CORS, host-check, transform, static and fs middlewares run.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-32395 (commit 175a83909f, \"reject requests with # in request-target\") is already in this tree. It shipped in the upstream vite 6.4.3 release that TuxCare onboarded. The dev server rejects any request whose req.url contains '#' with a 400 before the CORS, host-check, transform, static and fs middlewares run." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-11-03T23:58:45.680561+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 6.4.3 of vite. not_affected \u2014 The target Vite 6.4.3-tuxcare.2 is not affected by CVE-2025-46565. The upstream fix commit c22c43de612eebb6c182dd67850c24e4fab8cacb (authored by upstream maintainer green@sapphi.red) is present in HEAD and shipped in the upstream Vite 6.4.3 release before TuxCare onboarding. The fix adds a shouldServe validation callback in sirv options that checks file paths against server.fs.deny patterns bef...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 The target Vite 6.4.3-tuxcare.2 is not affected by CVE-2025-46565. The upstream fix commit c22c43de612eebb6c182dd67850c24e4fab8cacb (authored by upstream maintainer green@sapphi.red) is present in HEAD and shipped in the upstream Vite 6.4.3 release before TuxCare onboarding. The fix adds a shouldServe validation callback in sirv options that checks file paths against server.fs.deny patterns bef..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 6.4.3 of vite. not_affected \u2014 The target repository (Vite 6.4.3 at SHA a21f80eaf) is NOT AFFECTED by CVE-2025-58751. The vulnerability pattern (sirv library's improper directory boundary check using `startsWith()` without ensuring a trailing separator) was fixed by upstream Vite commit 63e2a5d23 authored by green@sapphi.red. The fix ensures the public directory path ends with a separator before comparison, preventing false ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 The target repository (Vite 6.4.3 at SHA a21f80eaf) is NOT AFFECTED by CVE-2025-58751. The vulnerability pattern (sirv library's improper directory boundary check using `startsWith()` without ensuring a trailing separator) was fixed by upstream Vite commit 63e2a5d23 authored by green@sapphi.red. The fix ensures the public directory path ends with a separator before comparison, preventing false ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 6.4.3 of vite. not_affected \u2014 CVE-2025-58752 is not present in the target Vite 6.4.3 repository. The vulnerability was fixed by upstream Vite in version 6.3.6 via commit 0ab19ea9f. The fix adds filesystem access validation to the indexHtmlMiddleware, preventing unauthorized access to HTML files outside allowed directories. Since the target version 6.4.3 is newer than 6.3.6, it inherits this upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 CVE-2025-58752 is not present in the target Vite 6.4.3 repository. The vulnerability was fixed by upstream Vite in version 6.3.6 via commit 0ab19ea9f. The fix adds filesystem access validation to the indexHtmlMiddleware, preventing unauthorized access to HTML files outside allowed directories. Since the target version 6.4.3 is newer than 6.3.6, it inherits this upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 6.4.3 of vite. not_affected \u2014 The target repository (Vite v6.4.3, SHA a21f80eaf) is NOT vulnerable to CVE-2025-62522. The upstream vendor fix from commit 1114b5d7e (released in Vite v6.4.1) is already present in the target codebase. This fix strips trailing slashes from file paths before checking against the server.fs.deny list, preventing attackers from bypassing the deny-list by appending trailing slashes or backslashes t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 The target repository (Vite v6.4.3, SHA a21f80eaf) is NOT vulnerable to CVE-2025-62522. The upstream vendor fix from commit 1114b5d7e (released in Vite v6.4.1) is already present in the target codebase. This fix strips trailing slashes from file paths before checking against the server.fs.deny list, preventing attackers from bypassing the deny-list by appending trailing slashes or backslashes t..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 6.4.3 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-20T18:41:00.126701+00:00", "status_notes": "Vulnerability CVE-2026-112943 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2026-112943" }, "action_statement": "Vulnerability CVE-2026-112943 affects version 6.4.3 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 6.4.3 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-27T11:19:57.803013+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 6.4.3 of vite, and is fixed in 6.4.3-tuxcare.2.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 6.4.3 of vite, and is fixed in 6.4.3-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-27T11:19:57.803013+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 6.4.3 of vite, and is fixed in 6.4.3-tuxcare.2.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 6.4.3 of vite, and is fixed in 6.4.3-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-31T13:23:59.275184+00:00", "status_notes": "Vulnerability CVE-2026-112947 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2026-112947" }, "action_statement": "Vulnerability CVE-2026-112947 affects version 6.4.3 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability CVE-2026-118662 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2026-118662" }, "action_statement": "Vulnerability CVE-2026-118662 affects version 6.4.3 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39363 does not affect version 6.4.3 of vite. CVE-2026-39363 is NOT present in Vite 6.4.3. The vulnerability (fetchModule accessible via WebSocket without server.fs access control) was fixed by upstream Vite maintainers in commit fe28e47e9 (\"fix: apply server.fs check to env transport #22159\"), released in v6.4.3 before TuxCare adoption. The fix disables fetchModule for client environments exposed via WebSocket by setting disableFetchModule: true, throwing an error before any file access occurs. All attribution rungs (A1-A4) failed - this is an upstream vendor fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39363" }, "impact_statement": "CVE-2026-39363 is NOT present in Vite 6.4.3. The vulnerability (fetchModule accessible via WebSocket without server.fs access control) was fixed by upstream Vite maintainers in commit fe28e47e9 (\"fix: apply server.fs check to env transport #22159\"), released in v6.4.3 before TuxCare adoption. The fix disables fetchModule for client environments exposed via WebSocket by setting disableFetchModule: true, throwing an error before any file access occurs. All attribution rungs (A1-A4) failed - this is an upstream vendor fix, not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-09-30T13:54:29.811509+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 6.4.3 of vite, and is fixed in 6.4.3-tuxcare.1.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 6.4.3 of vite, and is fixed in 6.4.3-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-09-30T13:54:29.811509+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 6.4.3 of vite, and is fixed in 6.4.3-tuxcare.1.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 6.4.3 of vite, and is fixed in 6.4.3-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53571 does not affect version 6.4.3 of vite. The target Vite v6.4.3 is NOT affected by CVE-2026-53571. The vulnerability (Windows path bypass via NTFS ADS and 8.3 short names) has been fixed by upstream commit 96b0c10162e9c55485d922db2cfc6b8227cbc176, which was included in the original v6.4.3 release. The fix adds checks in `isFileLoadingAllowed()` to reject paths containing `~` (8.3 short names) and `:` after drive letters (NTFS ADS), preventing attackers from accessing files that should be blocked by `server.fs.deny`.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53571" }, "impact_statement": "The target Vite v6.4.3 is NOT affected by CVE-2026-53571. The vulnerability (Windows path bypass via NTFS ADS and 8.3 short names) has been fixed by upstream commit 96b0c10162e9c55485d922db2cfc6b8227cbc176, which was included in the original v6.4.3 release. The fix adds checks in `isFileLoadingAllowed()` to reject paths containing `~` (8.3 short names) and `:` after drive letters (NTFS ADS), preventing attackers from accessing files that should be blocked by `server.fs.deny`." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.3", "identifiers": { "purl": "pkg:npm/vite@6.4.3" } } ], "timestamp": "2026-10-31T13:22:29.205538+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 6.4.3 of vite.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 6.4.3 of vite." } ] }