How to use this reference
Current Vite guidance recommends explicit trusted-origin and controlled-host lists, and warns against all-origin CORS and all-host acceptance. Editorial lesson: document three separate decisions: who may read HTTP responses, who may join a realtime channel and which hostname a service answers to. HTTP configuration does not substitute for WebSocket admission protection. Keep those policies narrow while reviewing reverse proxies and framework/plugin integrations. Select a currently supported patched release; inspect the actual deployment rather than treating a historical fix number as present-day upgrade advice.
Before reading
- Browser origins, HTTP response-sharing policy and WebSocket admission
- Development-server configuration and integration trust boundaries
Context and limits
- Affected versions listed by the advisory are <=4.5.5, 5.0.0–5.4.11 and 6.0.0–6.0.8; initial fixes are 4.5.6, 5.4.12 and 6.0.9.
- Applicability requires a running affected development server and user interaction with an untrusted page, even with loopback-only listening. Browser-specific qualifications describe 2025, not verified 2026 behavior.
- The source describes a demonstration of HMR-message and source-snippet disclosure. Broader source exposure is advisory-described; additional plugin/proxy consequences are conditional. The advisory says Vite core has no request-triggered functionality that changes other state.
- sapphi-red published the advisory; ivantsepp is credited as Reporter. Neither role establishes an article byline, so authors remains empty.
- Historical publication outside the preferred trailing-year window. Included for its server-side origin/hostname checks, complementing Chrome Local Network Access's browser connection-permission model and Open WebUI's session-revocation consistency case.
- Current server-option documentation is living guidance, not proof of January 2025 defaults or present browser-wide protection. No production compromise, individual award or independent reproduction is established. This educational case grants no testing authorization.
Sources and provenance
- Vite development-server security advisory GHSA-vg6x-rcgg-rjx6 Vite · reviewed 2026-10-06
- Vite Server Options Vite · reviewed 2026-10-06
Record reviewed 2026-10-06. Snapshot cb017eaea66e. Open the complete JSON contract.