CVE-2025-62522: vite allows server.fs.deny bypass via backslash on Windows
Summary Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.
Impact Only apps that match the following conditions are affected:
- explicitly exposes the Vite dev server to the network (using --host or server.host config option) - running the dev server on Windows
Details server.fs.deny can contain patterns matching against files (by default it includes .env, .env., .{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.
PoC shell npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env\ http://localhost:5173 <img width="1593" height="616" alt="image" src="https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175" />
Other sources
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62522?
The severity of CVE-2025-62522 is considered moderate due to the improper handling of files in development environments.
How do I fix CVE-2025-62522?
To fix CVE-2025-62522, upgrade to Vite version 5.4.21 or later.
Who is affected by CVE-2025-62522?
CVE-2025-62522 affects applications using Vite versions between 5.2.6 and 5.4.20, as well as earlier versions that do not implement the fix.
What is the nature of the vulnerability in CVE-2025-62522?
CVE-2025-62522 allows files denied by server.fs.deny to be sent when the development server runs on Windows and the URL ends with \.
Is there a workaround for CVE-2025-62522 if I cannot upgrade?
There is no official workaround for CVE-2025-62522; upgrading to a fixed version is highly recommended.