Affected Systems

Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Internet-exposed Vite development servers (typically port 5173) running with --host flag, server.host configuration, or misconfigured Docker port mappings. AWS and Azure cloud deployments with credentials accessible to compromised servers.

Exploitation Status

Active mass-scanning campaign detected. CVE-2026-39364 actively exploited alongside CVE-2025-30208, CVE-2025-31125 (flagged as actively exploited by CISA), and CVE-2024-45811. Over 800 attacks and 32,000 raw events observed in one month via F5 honeypots. Attackers using Google Cloud IP ranges, primarily from US, Belgium, and Netherlands.

Business Impact

Attackers can bypass file access controls to steal cloud credentials (.env files, AWS credentials, Azure tokens), Terraform state files, and serverless configurations from exposed development servers. Successful exploitation grants unauthorized access to production cloud infrastructure, enabling lateral movement, data exfiltration, and resource hijacking. Development teams frequently expose Vite servers unintentionally through Docker misconfigurations or convenience flags, expanding attack surface beyond typical production systems.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately update Vite to version 7.3.3+ or 8.0.5+ to patch CVE-2026-39364, CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811
  • Audit network configurations to ensure Vite dev servers (port 5173) are bound to localhost only; remove --host flags and review server.host settings and Docker port mappings
  • Block inbound traffic to port 5173 at firewall and implement WAF rules to detect/block suspicious /@fs/ path requests and encoded traversal sequences
  • Blocklist attacker IPs: 34.14.15.105, 34.16.200.129, 34.11.196.206 and monitor for connections from Google Cloud IP ranges targeting development ports
  • Rotate all AWS credentials, Azure tokens, API keys, and secrets on systems where Vite was publicly exposed; review CloudTrail and Azure Activity Logs for unauthorized access from April 7, 2026 onward