npmPackage

@vitest/browser

5 known vulnerabilities (3 critical, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 5.1.0 (Nov 2, 2026): no advisory affects it
Newest unaffected release: 5.1.0 (Nov 2, 2026), the latest release
Advisories: 5 · 3 critical, 2 medium

Weekly downloads: 20.1M
Dependents: 41
Releases: 244 since 0.19.0 (Jul 24, 2022)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-112948
Affects 5.0.0-beta.6 to 5.0.4 (5.0.5 is outside it)
CVE-2026-73653
Affects 0.19.0 to 3.2.6 (3.2.7 is outside it); 4.0.0 to 4.1.9 (4.1.10 is outside it); 5.0.0-beta.1 to 5.0.0-beta.5 (5.0.0-beta.6 is outside it)
CVE-2026-53633
Affects 3.0.0 to 3.2.4 (3.2.5 is outside it); 4.0.0 to 4.1.7 (4.1.8 is outside it); 5.0.0-beta.1 to 5.0.0-beta.3 (5.0.0-beta.4 is outside it)
CVE-2026-47428
Affects 4.0.17 to 4.1.5 (4.1.6 is outside it); 5.0.0-beta.1 to 5.0.0-beta.2 (5.0.0-beta.3 is outside it)
CVE-2025-24963
Affects 2.0.4 to 2.1.8 (2.1.9 is outside it); 3.0.0 to 3.0.3 (3.0.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

CVE-2026-112948Medium 6.5
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Affected: from 5.0.0-beta.6, fixed in 5.0.5.
Fixed in 5.0.5 (released Oct 15, 2026, 5 days before disclosure).
The latest release, 5.1.0, is not affected.
11% of @vitest/browser downloads last week were affected versions (2.4M).
CVE-2026-73653Critical 9.4
Vitest: Browser Mode provider commands bypass the file-access permission gate
Affected: from 4.0.0, fixed in 4.1.10; fixed in 3.2.7; from 5.0.0-beta.1, fixed in 5.0.0-beta.6.
Fixed in 3.2.7 (released Jul 6, 2026, 38 days before disclosure), 4.1.10 (released Jul 6, 2026, 38 days before disclosure) and 5.0.0-beta.6 (released Jul 6, 2026, 38 days before disclosure).
The latest release, 5.1.0, is not affected.
19% of @vitest/browser downloads last week were affected versions (4.2M).
CVE-2026-53633Critical 9.8
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Affected: from 5.0.0-beta.0, fixed in 5.0.0-beta.4; from 4.0.0, fixed in 4.1.8; from 3.0.0, fixed in 3.2.5.
Fixed in 3.2.5 (released Jun 1, 2026, 43 days before disclosure), 4.1.8 (released Jun 1, 2026, 43 days before disclosure) and 5.0.0-beta.4 (released Jun 1, 2026, 43 days before disclosure).
The latest release, 5.1.0, is not affected.
15% of @vitest/browser downloads last week were affected versions (3.2M).
CVE-2026-47428Critical 9.6
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
Affected: from 4.0.17, fixed in 4.1.6; from 5.0.0-beta.0, fixed in 5.0.0-beta.3.
Fixed in 4.1.6 (released May 11, 2026, 64 days before disclosure) and 5.0.0-beta.3 (released May 19, 2026, 56 days before disclosure).
The latest release, 5.1.0, is not affected.
4.4% of @vitest/browser downloads last week were affected versions (972.1K).
CVE-2025-24963Medium 5.9
Browser mode serves arbitrary files in vitest
Affected: from 2.0.4, fixed in 2.1.9; from 3.0.0, fixed in 3.0.4.
Fixed in 2.1.9 (released Feb 3, 2025, 1 day before disclosure) and 3.0.4 (released Jan 23, 2025, 12 days before disclosure).
The latest release, 5.1.0, is not affected.
<0.1% of @vitest/browser downloads last week were affected versions (21.8K).