GHSA-356w-63v5-8wf4 CVE-2025-32395
Vite has an `server.fs.deny` bypass with an invalid `request-target`
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 1.77%
- Chance of exploitation in the next 30 days. Higher than 78.20% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Fix
6.2.6- Upgrade vite to this version or later
Description
Summary
The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun.
Impact
Only apps with the following conditions are affected.
- explicitly exposing the Vite dev server to the network (using --host or server.host config option)
- running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun)
Details
HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2 (ref1, ref2, ref3).
On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check.
On Deno, those requests are not rejected internally and is passed to the user land as well. But for those requests, the value of http.IncomingMessage.url did not contain #.
PoC
npm create vite@latest
cd vite-project/
npm install
npm run dev
send request to read /etc/passwd
curl --request-target /@fs/Users/doggy/Desktop/vite-project/#/../../../../../etc/passwd http://127.0.0.1:5173
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| vite | >= 6.2.0, < 6.2.6 |
6.2.6 |
| vite | >= 6.1.0, < 6.1.5 |
6.1.5 |
| vite | >= 6.0.0, < 6.0.15 |
6.0.15 |
| vite | >= 5.0.0, < 5.4.18 |
5.4.18 |
| vite | < 4.5.13 |
4.5.13 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
vite npm → 6.2.6
- npm
npm install vite@6.2.6- yarn
yarn add vite@6.2.6- pnpm
pnpm add vite@6.2.6
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query | High Known exploited | Also affects vite |
| GHSA-8g5g-mxqh-grgj Vite: `server.fs.deny` bypassed with queries | Medium | Also affects vite |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` | Medium | Also affects vite |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine | Medium | Also affects vite |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware | Low | Also affects vite |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors | Medium | Also affects vite |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows | Medium | Also affects vite |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | High | Also affects vite |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor