Überprüfung des Secret-Leaks im Vitest-Entwicklungsserver (CVE-2026-112948)

Executive Summary & Vulnerability Context

On October 21, 2026, the GitHub Advisory Database published CVE-2026-112948 (GHSA-p458-7748-mcp3), exposing a critical file access misconfiguration in Vitest 5 dev servers.

Under specific developer configurations—specifically when running the interactive UI (vitest --ui), Browser Mode (@vitest/browser), or when enabling the remote api flag—Vitest’s underlying HTTP server failed to apply Vite’s default server.fs.deny rules.

The outcome: sensitive project assets that Vite ordinarily guards by default—including .env, .env.local, .npmrc, private SSL certificates, .git metadata, and Vitest’s internal authentication token file (.vitest-secret-token)—could be fetched over plain HTTP by any client reachable on the network or by a malicious browser tab via cross-origin requests.

Technical Root Cause: Why server.fs.deny Was Overridden

In a standard Vite configuration, server.fs.deny protects sensitive paths using built-in globs:

// Vite's built-in default deny patterns:
['.env', '.env.*', '*.{crt,pem}', '**/.git/**', '**/.npmrc']

When Vitest 5 introduced its internal API server and UI token authentication (.vitest-secret-token), it programmatically appended its token file to the deny list. However, two underlying Vite runtime behaviors caused a silent bypass:

1. Premature Array Overwrite: Vite only injects its default deny list when server.fs.deny is completely undefined. When Vitest assigned an array containing only ['.vitest-secret-token'], Vite’s default rules were discarded rather than merged.
2. Matcher Pre-Compilation: Vite compiles the deny list into an internal regex matcher during config resolution. Dynamic runtime mutations pushed later had zero effect on the active HTTP file serving pipeline.

If you ran vitest --ui on a local network or tested apps inside a browser with multi-tab sessions, any script capable of hitting localhost:51204 could scrape your secret keys.

Remediation Workflow & Token Rotation

1. Upgrade Vitest Dependencies

Vitest maintainers released patched releases addressing matcher compilation. Upgrade your project dependencies immediately:

npm install -D vitest@latest @vitest/ui@latest @vitest/browser@latest
# or with pnpm:
pnpm update vitest @vitest/ui @vitest/browser

2. Revoke and Re-issue Leaked Credentials

Treat all secrets residing in .env as compromised if Vitest UI was active on shared networks:

• Cloud provider access tokens (AWS, GCP, Cloudflare)
• Database credentials (Postgres, Redis, MongoDB connection URIs)
• OAuth 2.0 Client Secrets and JWT Signing Passphrases
• Third-party API keys (Stripe, Resend, GitHub PATs)

3. Generate High-Entropy Cryptographic Secrets Client-Side

When generating replacement tokens, avoid online generators that log inputs to server logs. Use the Web Crypto API (crypto.getRandomValues) for cryptographically strong pseudorandom numbers (CSPRNG):

function generateSecureToken(byteLength = 32): string {
  const bytes = new Uint8Array(byteLength);
  crypto.getRandomValues(bytes);
  return Array.from(bytes)
    .map(b => b.toString(16).padStart(2, '0'))
    .join('');
}

For immediate offline rotation without code boilerplate:

• Generate 256-bit API keys, Hex tokens, and RFC 4648 Base32 secrets using the client-side DevOmniTools Token Generator.
• Inspect decoded claims, audience, and expiration of rotated tokens safely with the DevOmniTools Offline JWT Decoder.

Defensive Hardening

Reinforce vitest.config.ts or vite.config.ts with explicit server.fs.strict and deny patterns:

import { defineConfig } from 'vitest/config';

export default defineConfig({
  server: {
    fs: {
      strict: true,
      deny: [
        '**/.env*',
        '**/*.pem',
        '**/*.key',
        '**/.git/**',
        '**/.npmrc',
        '**/.vitest-secret-token'
      ]
    }
  }
});