# What changed in @vitest/web-worker

> 7 changes in @vitest/web-worker 4 to 5 from its official release notes, upgrade guides and advisories: 7 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@vitest/web-worker/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @vitest/web-worker 5

### Security

- Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file (5.0.5) — [security advisory](https://github.com/advisories/GHSA-P458-7748-MCP3)
- Vitest: Code injection via unauthenticated manual mock registration (4.1.12, 5.0.3) — [security advisory](https://github.com/advisories/GHSA-QXG6-89MG-RQV8)
- Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix (4.1.12, 5.0.3) — [security advisory](https://github.com/advisories/GHSA-XP26-3454-MJGP)

## @vitest/web-worker 4

### Security

- Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (4.1.11) — [security advisory](https://github.com/advisories/GHSA-82FW-GWWQ-J7X9)
- @vitest/browser: Browser Mode provider commands bypass the file-access permission gate (3.2.7, 4.1.10) — [security advisory](https://github.com/advisories/GHSA-P63J-VCC4-9VMV)
- Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE (3.2.5, 4.1.8) — [security advisory](https://github.com/advisories/GHSA-G8MR-85JM-7XHM)
- Vitest browser mode serves unsanitized otelCarrier query parameter as inline script (4.1.6) — [security advisory](https://github.com/advisories/GHSA-2H32-95RG-CPPP)