Packages / vite / Security

ModerateVulnerabilityGHSA-859w-5945-r5v3CVE-2025-46565Published 30 Apr 2025

Vite's server.fs.deny bypassed with /. for files under project root

Affected releases · vite

  • 6.x6.0.0 – 6.3.3Fixed in 6.3.4
  • 5.x5.0.0 – 5.4.18Fixed in 5.4.19
  • 4.x4.0.0 – 4.5.13Fixed in 4.5.14
  • 3.x and older0.1.0 – 3.2.11No fix, no longer updated

On 6.x, the newest line:

npm install vite@6.3.4
8.x

  1. Not affected

    8.0.0 – 8.3.5

    34 releases, latest

6.x

  1. Affected

    6.0.0 – 6.1.5

    22 releases

  2. Fixed

    6.1.6

    1 release

  3. Affected

    6.2.0 – 6.2.6

    7 releases

  4. Fixed

    6.2.7

    1 release

  5. Affected

    6.3.0 – 6.3.3

    4 releases

  6. Fixed

    6.3.4 – 6.4.5

    10 releases

5.x

  1. Affected

    5.0.0 – 5.4.18

    64 releases

  2. Fixed

    5.4.19 – 5.4.21

    3 releases

4.x

  1. Affected

    4.0.0 – 4.5.13

    52 releases

  2. Fixed

    4.5.14

    1 release

3.x

  1. Affected

    3.0.0 – 3.2.11

    30 releases

2.x

  1. Affected

    2.0.0 – 2.9.18

    97 releases

0.x

  1. Affected

    0.1.0 – 0.20.10

    78 releases

440 stable releases of vite, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for vite. It is read in your browser and sent nowhere.

What happens

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed.

  • Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env

  • Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

image image