Read the docs
TI-2025-23473 Aliases CVE-2025-32395GHSA-356w-63v5-8wf4

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Priority MEDIUM 60CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) and running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun) are affected. This vulnerability is fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0181 78th percentileScored 2026-11-07
Fix Partial vite (vitejs): 6.2.6, 6.1.5, 6.0.15 +2vite (npm): 6.2.6, 6.1.5, 6.0.15 +2Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vitejsvite6.2.0 to before 6.2.6; 6.1.0 to before 6.1.5; 6.0.0 to before 6.0.15; 5.0.0 to before 5.4.18; before 4.5.136.2.6, 6.1.5, 6.0.15, 5.4.18, 4.5.13Patch availableCNA
—vite (npm)6.2.0 to before 6.2.66.2.6Patch availableGHSA-356w-63v5-8wf4
—vite (npm)6.1.0 to before 6.1.56.1.5Patch availableGHSA-356w-63v5-8wf4
—vite (npm)6.0.0 to before 6.0.156.0.15Patch availableGHSA-356w-63v5-8wf4
—vite (npm)5.0.0 to before 5.4.185.4.18Patch availableGHSA-356w-63v5-8wf4
—vite (npm)before 4.5.134.5.13Patch availableGHSA-356w-63v5-8wf4
  • vite Vendorvitejs Affected 6.2.0 to before 6.2.6; 6.1.0 to before 6.1.5; 6.0.0 to before 6.0.15; 5.0.0 to before 5.4.18; before 4.5.13 Fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, 4.5.13 Patch available CNA
  • vite (npm) Vendor— Affected 6.2.0 to before 6.2.6 Fixed in 6.2.6 Patch available GHSA-356w-63v5-8wf4
  • vite (npm) Vendor— Affected 6.1.0 to before 6.1.5 Fixed in 6.1.5 Patch available GHSA-356w-63v5-8wf4
  • vite (npm) Vendor— Affected 6.0.0 to before 6.0.15 Fixed in 6.0.15 Patch available GHSA-356w-63v5-8wf4
  • vite (npm) Vendor— Affected 5.0.0 to before 5.4.18 Fixed in 5.4.18 Patch available GHSA-356w-63v5-8wf4
  • vite (npm) Vendor— Affected before 4.5.13 Fixed in 4.5.13 Patch available GHSA-356w-63v5-8wf4

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:*——vitejs
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:* Versions — — ·vitejs

Remediation

  • Fix · CNA vite (vitejs) Fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, 4.5.13
  • Fix · GHSA-356w-63v5-8wf4 vite (npm) Fixed in 6.2.6 Advisory →
  • Fix · GHSA-356w-63v5-8wf4 vite (npm) Fixed in 6.1.5 Advisory →
  • Fix · GHSA-356w-63v5-8wf4 vite (npm) Fixed in 6.0.15 Advisory →
  • Fix · GHSA-356w-63v5-8wf4 vite (npm) Fixed in 5.4.18 Advisory →
  • Fix · GHSA-356w-63v5-8wf4 vite (npm) Fixed in 4.5.13 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat OpenShift distributed tracing 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32395
  2. 2026-10-03 Alias added: GHSA-356w-63v5-8wf4

References

Advisory 1

Other 3

  • TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
  • TI-2025-41248 Code injection in vitejs vite-plugin-react CVSS 3.1CRITICAL 9.8
  • TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
  • TI-2025-41735 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVSS 3.1HIGH 7.5
  • TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
  • TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences