A query string walks past server.fs.deny on Vite dev servers left on a public port
F5 counted about 32,000 events in August aimed at .env files and cloud credentials on internet-reachable Vite development servers. The fixed builds are 7.3.2 and 8.0.5, and the advice pairs them with binding the server back to localhost.
The Engineer · Build desk
What happened
- F5 observed about 32,000 events in August 2026 aimed at .env files and cloud credentials on public Vite development servers, including probes for CVE-2026-39364 and older Vite vulnerabilities.
- For CVE-2026-39364, requests carrying particular queries may retrieve files that server.fs.deny is supposed to block, and F5 saw the probes hitting endpoints such as /@fs/.
- The remediation is to move 7.x installs to 7.3.2 or later and 8.x installs to 8.0.5 or later.
- F5 also advises limiting development servers to localhost or required networks and blocking outside connections to the actual listening ports, including 5173/TCP, because changing ports alone is not sufficient.
Why it matters
- Who's exposed exposure Any host answering HTTP on a dev port is reachable by a stranger with no credentials and no click required. The report notes that on-screen warnings may not appear, so the developer whose laptop is serving the project sees nothing.
- Who has to decide decision What to inventory is the running process: a patched Vite on a public interface still answers everyone, so the second half of the work belongs to whoever controls the network.
- What it limits constraint A directly exposed server bypasses the proxy log, the first place most teams would look. An investigation runs instead on Vite's own records and on cloud audit trails that a development box was probably never wired into.
- What doesn't add up contradiction F5's 32,000 measures attempts, and F5 did not publish a figure for successful retrievals at ordinary organisations. The credential-theft reading rests on what the mechanism permits, while the measured quantity is scan volume.
Next story · Product · Sep 28
CISA wants NetScaler owners to check for intruders before installing Citrix's zero-day fixesConfirmed2 publishers
The Vite project titles its advisory "server.fs.deny bypassed with queries (CVE-2026-39364)" [24]. F5's traffic matches that description: requests to /@fs/ endpoints, with raw and import queries attached [6][12]. The request signature is greppable. The writeup does not explain how the query defeats the deny-pattern match.
A file comes back only when three conditions hold at once: the path sits inside server.fs.allow, it matches a server.fs.deny pattern, and the Vite process can read it [16]. So the bug widens what is readable inside the root already being served, and F5 notes that retrieval does not succeed for all scanned paths [17]. A .env in the project directory is the interesting case. A secret stored outside server.fs.allow is not reachable this way [16].
The published affected range starts at 7.1.0 [8], so an install pinned at 7.0.x sits outside it [27]. The same list carries a second condition that no upgrade touches: the development server is reachable by the attacker [8].
F5's August honeynet figures were 807 attacks aggregated by session and roughly 32,000 events [4][1]. That is about 40 requests per session [26], consistent with a scanner walking a candidate path list rather than aiming at one known file.
BleepingComputer, listed in the report as a related source, headlines the activity "Hackers target exposed Vite dev servers to steal AWS, Azure secrets" [23]. The report itself marks the step from leaked credentials to environment takeover as an inference [28].
If the server answered the internet directly, the requests never reach a proxy log [13]. That leaves Vite's own records: startup arguments, listening addresses, configuration files, and file reads where auditing is enabled [19]. Reads over HTTP do not spawn a child process, so process-creation telemetry stays quiet [19]. On the cloud side, requests to Vite alone do not confirm compromise. Confirmation has to come from AWS or Azure audit logs showing API operations, permission changes or data access with the suspect credentials [20]. Flow records will not identify which file left, because TLS hides the contents [22]. The bar the report sets for proving unauthorised access is target file contents appearing in responses to the attacker [25].
The report also notes that email logs are not a source for confirming initial intrusion [21].
What to watch
- A published count of successful file retrievals would move this from scanning volume to measured loss.
- Cloud audit entries showing API calls from credentials first seen in a /@fs/ response would close the chain F5 labels an inference.
- Any further advisory on the 7.3.x or 8.0.x lines, now that the deny list is a known target.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption42
- Hype gap+15
- Incentives58
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In August 2026, F5 observed approximately 32,000 events targeting .env files and cloud credentials on public Vite development servers.
- [2]
The observed activity included probes for CVE-2026-39364 and older Vite vulnerabilities.
- [3]
The event count does not establish how many systems were successfully compromised.
- [4]
In August 2026 honeynets, F5 observed 807 attacks aggregated by session and approximately 32,000 events targeting multiple Vite vulnerabilities.
- [5]
Attackers scan for Vite development servers reachable via ports such as 5173/TCP.
- [6]
F5 has observed requests to endpoints such as /@fs/.
- [7]
For CVE-2026-39364, specific requests with queries may allow retrieval of files that should be blocked by server.fs.deny.
- [8]
The affected version is 7.1.0 or later and less than 7.3.2, or 8.0.0 or later and less than 8.0.5, and the development server is reachable by the attacker.
- [9]
Limit development servers to localhost or necessary networks, and block unauthorized external connections to actual listening ports, including 5173/TCP; changing ports alone is not a sufficient countermeasure.
- [10]
The threat actor is external attackers who can send HTTP requests to exposed Vite development servers; no authentication or user interaction is required.
- [11]
No user interaction is required, and on-screen warnings may not appear.
- [12]
Reverse proxy and Vite logs may retain requests containing /@fs/, raw and import queries, and abnormal response sizes.
- [13]
If the server is exposed directly, records will not appear in reverse proxy access logs.
- [14]
Affected products are Vite 7.x and Vite 8.x.
- [15]
The number of successful file retrievals at general organizations has not been published.
- [16]
The sensitive files targeted by this CVE must be within the allowed range of server.fs.allow, match the blocking patterns of server.fs.deny, and be readable by the Vite process.
- [17]
Retrieval does not succeed for all scanned paths.
- [18]
Remediation: update 7.x versions to 7.3.2 or later, and 8.x versions to 8.0.5 or later.
- [19]
Investigators should check Vite process startup arguments, listening addresses, configuration files, and file reads if auditing is enabled; child process creation is not required for reads via HTTP.
- [20]
Requests to Vite alone do not confirm cloud compromise; AWS, Azure and other audit logs should be checked for API operations, permission changes and data access using the target credentials.
- [21]
Because this issue involves HTTP requests to Vite, email logs are not a source for confirming initial intrusion.
- [22]
Encrypted TLS traffic prevents identifying request contents or leaked files from flow information alone.
- [23]
A related source listed in the report is BleepingComputer, headlined "Hackers target exposed Vite dev servers to steal AWS, Azure secrets".
- [24]
A related source listed in the report is Vite Official, titled "server.fs.deny bypassed with queries (CVE-2026-39364)".
- [25]
Unauthorized access is proven by evidence such as target file contents appearing in responses to attackers.
- [26]
About 40 requests per session, taking F5's August honeynet totals together.
- [27]
A Vite install pinned at 7.0.x falls outside the published affected range.
- [28]
The report marks as an inference that the exposure of cloud credentials or state files may lead to environment takeover.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toVite CVE-2026-39364: Exploring Cloud Secrets from Exposed Development Servers
1 article · September 15, 2026
- scanning for exposed Vite dev servers
f5.com
1 article · September 15, 2026
Topics and entities
Topics
- Exposed developer tooling
- Path traversal and access-control bypass
- Cloud Credential Theft
- Mass vulnerability scanning