CVE-2025-62522

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.

Summary

Any files ending with .map even out side the project can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• have a sensitive content in files ending with .map and the path is predictable

Details

In Vite v7.3.1, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON.

PoC

1. Create a minimal PoC sourcemap outside the project root

   cat > /tmp/poc.map <<'EOF'
   {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""}
   EOF
   

2. Start the Vite dev server (example)

   pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080
   

3. Confirm that direct /@fs access is blocked by strict (returns 403) <img width="4004" height="1038" alt="image" src="https://github.com/user-attachments/assets/15a859a8-1dc6-4105-8d58-80527c0dd9ab" />
4. Inject ../ segments under the optimized deps .map URL prefix to reach /tmp/poc.map <img width="2790" height="846" alt="image" src="https://github.com/user-attachments/assets/5d02957d-2e6a-4c45-9819-3f024e0e81f2" />

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173

<img width="1593" height="616" alt="image" src="https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175" />

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• the sensitive file exists in the allowed directories specified by server.fs.allow
• the sensitive file is denied with a pattern that matches a file by server.fs.deny

Details

On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.

PoC

1. Start the dev server: pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort
2. Confirm that server.fs.deny is enforced (expect 403): curl -i http://127.0.0.1:5175/src/.env | head -n 20 <img width="3944" height="1092" alt="image" src="https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f" />
3. Confirm that the same files can be retrieved with query parameters (expect 200): <img width="2014" height="373" alt="image" src="https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8" />

Root has patched CVE-2025-62522 in the @rootio/vite package for Root:npm. Multiple fixed versions available.

TuxCare rebuilt 2 packages to address 5 CVEs. Fixed in 5.4.14-tuxcare.1.

TuxCare rebuilt vite to address 4 CVEs. Fixed in 5.4.14-tuxcare.2.

TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 4.5.5-tuxcare.7.

TuxCare rebuilt vite to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.

TuxCare rebuilt vite to address 4 CVEs. Fixed in 3.2.11-tuxcare.2.

TuxCare rebuilt vite to address 4 CVEs. Fixed in 4.5.14-tuxcare.1.

TuxCare rebuilt 5 packages to address 1 CVE. Fixed in 5.18.1-tuxcare.3.

TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.4-tuxcare.6.

TuxCare rebuilt vite to address 1 CVE. Fixed in 4.1.5-tuxcare.2.

TuxCare rebuilt vite to address 1 CVE. Fixed in 5.0.12-tuxcare.5.

TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.0-tuxcare.2.

TuxCare rebuilt vite to address 8 CVEs. Fixed in 5.4.10-tuxcare.4.

TuxCare rebuilt @nuxt/kit to address 1 CVE. Fixed in 3.12.4-tuxcare.6.

TuxCare rebuilt @astrojs/internal-helpers to address 1 CVE. Fixed in 5.18.1-tuxcare.3.

TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 3.12.4-tuxcare.6.

TuxCare rebuilt @astrojs/prism to address 1 CVE. Fixed in 5.18.1-tuxcare.3.

TuxCare rebuilt @astrojs/underscore-redirects to address 1 CVE. Fixed in 5.18.1-tuxcare.3.

TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.6.

TuxCare rebuilt @astrojs/upgrade to address 1 CVE. Fixed in 5.18.1-tuxcare.3.

TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.6.

TuxCare rebuilt @vitejs/plugin-react to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.

TuxCare rebuilt @vitejs/plugin-react to address 4 CVEs. Fixed in 3.2.11-tuxcare.2.