GHSA-859w-5945-r5v3: vite fixed in 6.3.4, 6.2.7, 6.1.6 and 2 more

GHSA-859w-5945-r5v3 PUBLISHED CVSS 6 MEDIUM

Duplicate

Record from GitHub Advisory Database · Published April 30, 2025

vite is fixed in 6.3.4, 6.2.7, 6.1.6 and 2 more (npm)

Duplicate

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
vite	npm	6.3.4, 6.2.7, 6.1.6, 5.4.19, 4.5.14
vitess-19.0	Chainguard	19.0.10-r9
vitess-21.0	Chainguard	21.0.4-r3
vitess-21.0	Wolfi	21.0.4-r3
vitess-18.0	Chainguard	18.0.8-r14
langfuse-2	Chainguard	2.95.12-r26
langfuse-fips-2	Chainguard	2.95.12-r28
vitess-20.0	Wolfi	20.0.7-r3
vite	Wolfi	6.3.4-r0
vitess-20.0	Chainguard	20.0.7-r3
vite	Chainguard	6.3.4-r0

Risk scores

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

Vendor	Product	Versions
chainguard	vitess-19.0	0
chainguard	vitess-21.0	0
wolfi	vitess-21.0	0
chainguard	vitess-18.0	0
chainguard	langfuse-2	0
chainguard	langfuse-fips-2	0
wolfi	vitess-20.0	0
wolfi	vite	0
chainguard	vitess-20.0	0
npm	vite	0
chainguard	vite	0

Timeline

Apr 30, 2025 CVE Published
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-859w-5945-r5v3
vulnetix vdb fixes GHSA-859w-5945-r5v3

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-859w-5945-r5v3/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →