Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3,     applications using custom middleware are vulnerable when they pass an unchanged browser request URL to     server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local     file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the     transformed HTML contains an inline module script and a victim browser loads the crafted development-     server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in     the Vite-served page. This execution can expose sensitive page data or permit critical actions available     to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.
    (CVE-2026-112945)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3,
    applications using custom middleware are vulnerable when they pass an unchanged browser request URL to
    server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local
    file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the
    transformed HTML contains an inline module script and a victim browser loads the crafted development-
    server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in
    the Vite-served page. This execution can expose sensitive page data or permit critical actions available
    to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.
    (CVE-2026-112945)

ID	Name	Product	Family	Type	Severity
372830	Linux Distros Unpatched Vulnerability : CVE-2026-112945	Nessus	Misc.	Local	low
476564	SCA: security update for vite, vite-plus (GHSA-9jrq-w75r-8gcw)	Tenable Cloud Security	SCA Checks	Local	low
476564	SCA: security update for vite, vite-plus (GHSA-9jrq-w75r-8gcw)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-112945

low

Tenable Plugins

low

low

low