Packages / vite / Security

ModerateVulnerabilityGHSA-93m4-6634-74q7CVE-2025-62522Published 20 Oct 2025

vite allows server.fs.deny bypass via backslash on Windows

Affected releases · vite

  • 7.x7.0.0 – 7.1.10Fixed in 7.1.11
  • 6.x6.0.0 – 6.4.0Fixed in 6.4.1
  • 5.x5.0.0 – 5.4.20Fixed in 5.4.21
  • 4.x and older2.9.18 – 4.5.14No fix, no longer updated

On 7.x, the newest line:

npm install vite@7.1.11
8.x

  1. Not affected

    8.0.0 – 8.3.5

    34 releases, latest

7.x

  1. Affected

    7.0.0 – 7.0.7

    8 releases

  2. Fixed

    7.0.8

    1 release

  3. Affected

    7.1.0 – 7.1.10

    11 releases

  4. Fixed

    7.1.11 – 7.3.7

    16 releases

6.x

  1. Affected

    6.0.0 – 6.4.0

    40 releases

  2. Fixed

    6.4.1 – 6.4.5

    5 releases

5.x

  1. Affected

    5.0.0 – 5.4.20

    66 releases

  2. Fixed

    5.4.21

    1 release

4.x

  1. Affected

    4.0.0 – 4.5.14

    53 releases

3.x

  1. Affected

    3.0.0 – 3.2.11

    30 releases

2.x

  1. Not affected

    2.0.0 – 2.9.17

    96 releases

  2. Affected

    2.9.18

    1 release

440 stable releases of vite, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for vite. It is read in your browser and sent nowhere.

What happens

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)

  • running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173