Skip to content

[Security] Bump vite from 6.0.3 to 6.1.0

Dependabot requested to merge dependabot-npm_and_yarn-vite-6.1.0 into main

Bumps vite from 6.0.3 to 6.1.0. This update includes a security fix.

Vulnerabilities fixed

Websites were able to send any requests to the development server and read the response in vite

Summary

Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections.

[!WARNING] This vulnerability even applies to users that only run the Vite dev server on the local machine.

Upgrade Path

Users that does not match either of the following conditions should be able to upgrade to a newer version of Vite that fixes the vulnerability without any additional configuration.

  • Using the backend integration feature
  • Using a reverse proxy in front of Vite
  • Accessing the development server via a domain other than localhost or *.localhost
  • Using a plugin / framework that connects to the WebSocket server on their own from the browser

Using the backend integration feature

If you are using the backend integration feature and not setting server.origin, you need to add the origin of the backend server to the server.cors.origin option. Make sure to set a specific origin rather than *, otherwise any origin can access your development server.

Using a reverse proxy in front of Vite

If you are using a reverse proxy in front of Vite and sending requests to Vite with a hostname other than localhost or *.localhost, you need to add the hostname to the new server.allowedHosts option. For example, if the reverse proxy is sending requests to http://vite:5173, you need to add vite to the server.allowedHosts option.

... (truncated)

Patched versions: 4.5.6; 5.4.12; 6.0.9 Affected versions: = 6.0.0, <= 6.0.8

Release notes

Sourced from vite's releases.

create-vite@6.1.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.1.0 (2025-02-05)

Features

Fixes

... (truncated)

Commits
  • 3734f80 fix(css): escape double quotes in url() when lightningcss is used (#18997)
  • 2b4f115 fix(deps): update all non-major dependencies (#18996)
  • 12b612d fix: fallback terser to main thread when function options are used (#18987)
  • d88d000 fix(deps): update all non-major dependencies (#18967)
  • 21680bd fix(css): skip non css in custom sass importer (#18970)
  • 62fad6d chore(deps): update dependency @​rollup/plugin-node-resolve to v16 (#18968)
  • 8a6bb4e fix(optimizer): keep NODE_ENV as-is when keepProcessEnv is true (#18899)
  • 7d6dd5d fix(ssr): recreate ssrCompatModuleRunner on restart (#18973)
  • c4b532c fix(css): root relative import in sass modern API on Windows (#18945)
  • 27f691b refactor: make internal invoke event to use the same interface with `handleIn...
  • Additional commits viewable in compare view

Merge request reports