Latest stable Vite: 8.3.5, released (release notes). 188 stable releases since 5 Jan 2024.
Vite
- 3majors patched in the last 60 days
- 18days with fixes on several majors
- 11advisories in 2026
- 188stable releases since Jan 2024
- 3days between stable releases, median
- 19in Apr 2025, the busiest month
- 64days, the longest wait (7 Jan 2026 to 12 Mar 2026)
Vite 8.3.5 and 6.4.5 went out on the same day, 21 October 2026. Vite now patches three majors side by side, 8.3, 7.3 and 6.4, and on five days this year the same fixes went out on several of them together.
Most of those were security days. Since April the team has published eleven advisories in three batches, each one in the dev server or in launch-editor, the package it uses to open files in your editor. The April three only matter when the dev server is exposed with --host. The October batch includes arbitrary command execution through launch-editor on Windows.
As of 24 October 2026. Vite security advisories.
Latest releases
8.3.5Build fixes for chunk import maps and their hashing.6.4.5Checks server.fs after the query string is stripped too.8.3.4Bundled dev mode supports import.meta.hot.acceptExports.6.4.4Security release: launch-editor update and stricter transform access checks.7.3.7The October security fixes on the 7.3 line.
From @vite_js on X
We've published multiple advisories affecting the dev server.
The main one is an arbitrary command execution when using some editors or through launch-editor on Windows.
Update now to the patched versions:
- Vite 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4
- Vite+ 1.1.0
Report links 👇🏻
The October batch: six advisories, patched on five release lines at once.
Today, VoidZero joins Cloudflare.
Vite remains MIT, vendor-neutral, and stewarded by the same wider team.
The same goes for Vitest, Rolldown, and Oxc.
Cloudflare is also committing $1M to an OSS fund to support independent development in the Vite ecosystem.
VoidZero, the company behind Vite, Vitest, Rolldown and Oxc, joined Cloudflare on 4 June 2026.
