CVE-2025-62522
MediumCVSS 6.0Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server was running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected.
Risk Assessment
An attacker can access files that should be blocked by the server.fs.deny configuration, potentially leading to data leakage. The risk applies only to Windows development environments with an exposed Vite server.
Recommendation
Upgrade Vite to version 5.4.21, 6.4.1, 7.0.8, or 7.1.11. Do not expose the Vite dev server to untrusted networks.
Other vulnerabilities in Vite
See all- CVE-2025-31125MediumActively exploited
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
- CVE-2026-53571High
Vite is a frontend tooling framework for JavaScript that, prior to versions 8.0.16, 7.3.5, and 6.4.3, could return the contents of files specified by server.fs.deny to the browser on Windows. Issues with NTFS ADS path normalization allowed unauthorized access to sensitive files.
- CVE-2026-39365Medium
Vite, a frontend tooling framework for JavaScript, versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, has a vulnerability in handling .map requests for optimized dependencies. The dev server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing bypass of the server.fs.strict allow list and retrieval of .map files outside the project root if they can be parsed as valid source map JSON.
- CVE-2026-39364High
Vite versions 7.1.0 to before 7.3.2 and 8.0.5 allow bypassing server.fs.deny restrictions. Files like .env or *.crt can be retrieved with HTTP 200 by appending query parameters ?raw, ?import&raw, or ?import&url&inline.
- CVE-2026-39363High
A vulnerability in Vite (a frontend tooling framework for JavaScript) from 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5 allows an attacker who can connect to the Vite dev server's WebSocket without an Origin header to invoke fetchModule via the vite:invoke event and read arbitrary files on the server as a JavaScript string. HTTP access controls are not applied to this WebSocket channel.
- CVE-2025-58752Medium
Vite before versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 serves any HTML files on the machine regardless of server.fs settings. Affects apps that expose the dev server to the network and use appType 'spa' or 'mpa'. The preview server is also vulnerable.
- CVE-2023-34092High
Vite, a frontend tooling, has a vulnerability that allows bypassing server options (`server.fs.deny`) using double forward-slash (//). This enables unauthenticated users to read files from the Vite application's root path, including default `fs.deny` settings.
Original NVD description (English source)
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS