---
id: CVE-2026-84373
title: Vitest is a testing framework powered by Vite
summary: >-
  Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and
  5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports
  in packages/mocker/src/node/interceptorPlugin.ts register the
  vitest:interceptor:regi…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: vitest
product: '@vitest/mocker'
affected:
  - '@vitest/mocker >= 2.1.0, < 4.1.11'
  - 'vitest >= 2.1.0, < 4.1.11'
  - 'vitest >= 5.0.0-beta.1, < 5.0.0-rc.2'
  - '@vitest/mocker >= 5.0.0-beta.1, < 5.0.0-rc.2'
patched:
  - '@vitest/mocker 4.1.11'
  - vitest 4.1.11
  - vitest 5.0.0-rc.2
  - '@vitest/mocker 5.0.0-rc.2'
published: '2026-09-01'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84373'
references:
  - url: >-
      https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8
    label: security-advisories@github.com
  - url: >-
      https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4
    label: security-advisories@github.com
  - url: >-
      https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f
    label: security-advisories@github.com
  - url: 'https://github.com/vitest-dev/vitest/pull/10972'
    label: security-advisories@github.com
  - url: 'https://github.com/vitest-dev/vitest/pull/10974'
    label: security-advisories@github.com
  - url: 'https://github.com/vitest-dev/vitest/releases/tag/v4.1.11'
    label: security-advisories@github.com
  - url: 'https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84373'
  - url: 'https://github.com/advisories/GHSA-82fw-gwwq-j7x9'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00527
epssPercentile: 0.42236
aliases:
  - GHSA-82fw-gwwq-j7x9
ecosystem: npm
ingestedAt: '2026-09-08T21:11:12.322Z'
---

## Overview

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84373)

Affected packages:

- `@vitest/mocker >= 2.1.0, < 4.1.11`
- `vitest >= 2.1.0, < 4.1.11`
- `vitest >= 5.0.0-beta.1, < 5.0.0-rc.2`
- `@vitest/mocker >= 5.0.0-beta.1, < 5.0.0-rc.2`

Patched in:

- `@vitest/mocker 4.1.11`
- `vitest 4.1.11`
- `vitest 5.0.0-rc.2`
- `@vitest/mocker 5.0.0-rc.2`

Source: https://github.com/advisories/GHSA-82fw-gwwq-j7x9