# @vitest/browser (npm) vulnerabilities 5 known vulnerabilities (3 critical, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.1.0 (Nov 2, 2026): no advisory affects it - Newest unaffected release: 5.1.0 (Nov 2, 2026), the latest release - Weekly downloads: 20.1M - Dependents: 41 - Releases: 244 since 0.19.0 (Jul 24, 2022) - Registry: https://www.npmjs.com/package/@vitest/browser - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-112948: 5.0.0-beta.6 to 5.0.4 (5.0.5 is outside it) - CVE-2026-73653: 0.19.0 to 3.2.6 (3.2.7 is outside it); 4.0.0 to 4.1.9 (4.1.10 is outside it); 5.0.0-beta.1 to 5.0.0-beta.5 (5.0.0-beta.6 is outside it) - CVE-2026-53633: 3.0.0 to 3.2.4 (3.2.5 is outside it); 4.0.0 to 4.1.7 (4.1.8 is outside it); 5.0.0-beta.1 to 5.0.0-beta.3 (5.0.0-beta.4 is outside it) - CVE-2026-47428: 4.0.17 to 4.1.5 (4.1.6 is outside it); 5.0.0-beta.1 to 5.0.0-beta.2 (5.0.0-beta.3 is outside it) - CVE-2025-24963: 2.0.4 to 2.1.8 (2.1.9 is outside it); 3.0.0 to 3.0.3 (3.0.4 is outside it) ## Advisories (5) ### [CVE-2026-112948](https://cve.now/CVE-2026-112948): Vitest: Servers misapply \`server.fs.deny\`, serving \`.env\`, private keys, \`.git\`, and the API token file - Severity: Medium 6.5 - Published: Oct 20, 2026 - Affected: from 5.0.0-beta.6, fixed in 5.0.5. - Fixed in 5.0.5 (released Oct 15, 2026, 5 days before disclosure). - The latest release, 5.1.0, is not affected. - 11% of @vitest/browser downloads last week were affected versions (2.4M). ### [CVE-2026-73653](https://cve.now/CVE-2026-73653): Vitest: Browser Mode provider commands bypass the file-access permission gate - Severity: Critical 9.4 - Published: Aug 13, 2026 - Affected: from 4.0.0, fixed in 4.1.10; fixed in 3.2.7; from 5.0.0-beta.1, fixed in 5.0.0-beta.6. - Fixed in 3.2.7 (released Jul 6, 2026, 38 days before disclosure), 4.1.10 (released Jul 6, 2026, 38 days before disclosure) and 5.0.0-beta.6 (released Jul 6, 2026, 38 days before disclosure). - The latest release, 5.1.0, is not affected. - 19% of @vitest/browser downloads last week were affected versions (4.2M). ### [CVE-2026-53633](https://cve.now/CVE-2026-53633): Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE - Severity: Critical 9.8 - Published: Jul 14, 2026 - Affected: from 5.0.0-beta.0, fixed in 5.0.0-beta.4; from 4.0.0, fixed in 4.1.8; from 3.0.0, fixed in 3.2.5. - Fixed in 3.2.5 (released Jun 1, 2026, 43 days before disclosure), 4.1.8 (released Jun 1, 2026, 43 days before disclosure) and 5.0.0-beta.4 (released Jun 1, 2026, 43 days before disclosure). - The latest release, 5.1.0, is not affected. - 15% of @vitest/browser downloads last week were affected versions (3.2M). ### [CVE-2026-47428](https://cve.now/CVE-2026-47428): Vitest browser mode serves unsanitized otelCarrier query parameter as inline script - Severity: Critical 9.6 - Published: Jul 14, 2026 - Affected: from 4.0.17, fixed in 4.1.6; from 5.0.0-beta.0, fixed in 5.0.0-beta.3. - Fixed in 4.1.6 (released May 11, 2026, 64 days before disclosure) and 5.0.0-beta.3 (released May 19, 2026, 56 days before disclosure). - The latest release, 5.1.0, is not affected. - 4.4% of @vitest/browser downloads last week were affected versions (972.1K). ### [CVE-2025-24963](https://cve.now/CVE-2025-24963): Browser mode serves arbitrary files in vitest - Severity: Medium 5.9 - Published: Feb 4, 2025 - Affected: from 2.0.4, fixed in 2.1.9; from 3.0.0, fixed in 3.0.4. - Fixed in 2.1.9 (released Feb 3, 2025, 1 day before disclosure) and 3.0.4 (released Jan 23, 2025, 12 days before disclosure). - The latest release, 5.1.0, is not affected. - <0.1% of @vitest/browser downloads last week were affected versions (21.8K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@vitest/browser Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.