CVE-2025-46565
Vite's server.fs.deny bypassed with /. for files under project root
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Vite's server.fs.deny bypassed with /. for files under project root
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
- Record
CVE-2025-46565- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2025-12770
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
- Record
EUVD-2025-12770- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-859w-5945-r5v3
Vite's server.fs.deny bypassed with /. for files under project root
Summary
The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.
Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.
- Examples of file matching patterns:
.env,.env.*,*.{crt,pem},**/.env - Examples of other patterns:
**/.git/**,.git/**,.git/**/*
Details
server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).
PoC
npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173
- Record
GHSA-859w-5945-r5v3- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
- Record
CVE-2025-46565- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Vite's server.fs.deny bypassed with /. for files under project root
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
- Record
CVE-2025-46565- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-04
OSVGHSA-859w-5945-r5v3
Vite's server.fs.deny bypassed with /. for files under project root
Summary
The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.
Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.
- Examples of file matching patterns:
.env,.env.*,*.{crt,pem},**/.env - Examples of other patterns:
**/.git/**,.git/**,.git/**/*
Details
server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).
PoC
npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173
- Record
GHSA-859w-5945-r5v3- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 8 moreShow less
OSVCLSA-2026-1775089661 No score
TuxCare security update for 2 packages (5 CVEs)
TuxCare rebuilt 2 packages to address 5 CVEs. Fixed in 5.4.14-tuxcare.1.
- Record
CLSA-2026-1775089661- Updated
- 2026-11-02
OSVCLSA-2026-1777509608 No score
TuxCare security update for vite (11 CVEs)
TuxCare rebuilt vite to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.
- Record
CLSA-2026-1777509608- Updated
- 2026-11-02
OSVCLSA-2026-1777509610 No score
TuxCare security update for vite (6 CVEs)
TuxCare rebuilt vite to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.
- Record
CLSA-2026-1777509610- Updated
- 2026-11-02
OSVCLSA-2026-1789031855 No score
TuxCare security update for vite (16 CVEs)
TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.
- Record
CLSA-2026-1789031855- Updated
- 2026-11-02
OSVCLSA-2026-1791897792 No score
TuxCare security update for vite (8 CVEs)
TuxCare rebuilt vite to address 8 CVEs. Fixed in 5.4.10-tuxcare.4.
- Record
CLSA-2026-1791897792- Updated
- 2026-11-02
OSVCLSA-2026-1792225950 No score
TuxCare security update for @vitejs/plugin-react (11 CVEs)
TuxCare rebuilt @vitejs/plugin-react to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.
- Record
CLSA-2026-1792225950- Updated
- 2026-11-02
OSVCLSA-2026-1792225952 No score
TuxCare security update for @vitejs/plugin-react (6 CVEs)
TuxCare rebuilt @vitejs/plugin-react to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.
- Record
CLSA-2026-1792225952- Updated
- 2026-11-02
OSVCLSA-2026-1792764572 No score
TuxCare security update for vite (1 CVE)
TuxCare rebuilt vite to address 1 CVE. Fixed in 4.5.5-tuxcare.10.
- Record
CLSA-2026-1792764572- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vitenpm |
6.3.0 to 6.3.3 | 6.3.4 |
vitenpm |
6.2.0 to 6.2.6 | 6.2.7 |
vitenpm |
6.0.0 to 6.1.5 | 6.1.6 |
vitenpm |
5.0.0 to 5.4.18 | 5.4.19 |
vitenpm |
through 4.5.13 | 4.5.14 |
@vitejs/plugin-legacyTuxCare:npm From an advisory covering 4 CVEs |
5.4.14-tuxcare.0 up to 5.4.14-tuxcare.1, plus listed versions 5.4.14 |
5.4.14-tuxcare.1 |
viteTuxCare:npm From an advisory covering 4 CVEs |
5.4.14-tuxcare.0 up to 5.4.14-tuxcare.1, plus listed versions 5.4.14 |
5.4.14-tuxcare.1 |
viteTuxCare:npm From an advisory covering 11 CVEs |
2.9.18-tuxcare.0 up to 2.9.18-tuxcare.1, plus listed versions 2.9.18 |
2.9.18-tuxcare.1 |
viteTuxCare:npm From an advisory covering 6 CVEs |
3.2.11-tuxcare.0 up to 3.2.11-tuxcare.1, plus listed versions 3.2.11 |
3.2.11-tuxcare.1 |
viteTuxCare:npm From an advisory covering 16 CVEs |
4.1.5-tuxcare.0 up to 4.1.5-tuxcare.1, plus listed versions 4.1.5 |
4.1.5-tuxcare.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
viteTuxCare:npm From an advisory covering 8 CVEs |
5.4.10-tuxcare.0 up to 5.4.10-tuxcare.4, plus listed versions 5.4.105.4.10-tuxcare.15.4.10-tuxcare.25.4.10-tuxcare.3 |
5.4.10-tuxcare.4 |
@vitejs/plugin-reactTuxCare:npm From an advisory covering 11 CVEs |
2.9.18-tuxcare.0 up to 2.9.18-tuxcare.1, plus listed versions 2.9.18 |
2.9.18-tuxcare.1 |
@vitejs/plugin-reactTuxCare:npm From an advisory covering 6 CVEs |
3.2.11-tuxcare.0 up to 3.2.11-tuxcare.1, plus listed versions 3.2.11 |
3.2.11-tuxcare.1 |
viteTuxCare:npm |
4.5.5-tuxcare.0 up to 4.5.5-tuxcare.10, plus listed versions 4.5.54.5.5-tuxcare.14.5.5-tuxcare.24.5.5-tuxcare.34.5.5-tuxcare.4 Show 5 moreShow less4.5.5-tuxcare.54.5.5-tuxcare.64.5.5-tuxcare.74.5.5-tuxcare.84.5.5-tuxcare.9 |
4.5.5-tuxcare.10 |
vitenpm |
6.3.0 up to 6.3.4 | 6.3.4 |
vitenpm |
6.2.0 up to 6.2.7 | 6.2.7 |
vitenpm |
6.0.0 up to 6.1.6 | 6.1.6 |
vitenpm |
5.0.0 up to 5.4.19 | 5.4.19 |
vitenpm |
before 4.5.14 | 4.5.14 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Vite Dev Server - Information Exposure |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-46565 is a medium vulnerability (CVSS 6.0) in Vitejs Vite, published April 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in vite 6.3.4.
References
github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3
nvd.nist.gov/vuln/detail/CVE-2025-46565