Read the docs
TI-2026-38634 Aliases CVE-2026-53571GHSA-fx2h-pf6j-xcff

Vite: `server.fs.deny` bypass on Windows alternate paths

Priority HIGH 69CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00577 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vite (vitejs): 8.0.16, 7.3.5, 6.4.3vite (npm): 8.0.16, 7.3.5, 6.4.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vitejsvite8.0.0 to before 8.0.16; 7.0.0 to before 7.3.5; before 6.4.38.0.16, 7.3.5, 6.4.3Patch availableCNA
—vite (npm)8.0.0 to before 8.0.168.0.16Patch availableGHSA-fx2h-pf6j-xcff
—vite (npm)7.0.0 to before 7.3.57.3.5Patch availableGHSA-fx2h-pf6j-xcff
—vite (npm)before 6.4.36.4.3Patch availableGHSA-fx2h-pf6j-xcff
—vite-plus (npm)before 0.1.240.1.24Patch availableGHSA-fx2h-pf6j-xcff
  • vite Vendorvitejs Affected 8.0.0 to before 8.0.16; 7.0.0 to before 7.3.5; before 6.4.3 Fixed in 8.0.16, 7.3.5, 6.4.3 Patch available CNA
  • vite (npm) Vendor— Affected 8.0.0 to before 8.0.16 Fixed in 8.0.16 Patch available GHSA-fx2h-pf6j-xcff
  • vite (npm) Vendor— Affected 7.0.0 to before 7.3.5 Fixed in 7.3.5 Patch available GHSA-fx2h-pf6j-xcff
  • vite (npm) Vendor— Affected before 6.4.3 Fixed in 6.4.3 Patch available GHSA-fx2h-pf6j-xcff
  • vite-plus (npm) Vendor— Affected before 0.1.24 Fixed in 0.1.24 Patch available GHSA-fx2h-pf6j-xcff

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*before 6.4.3; 7.0.0 to before 7.3.5; 8.0.0 to before 8.0.16Vulnerablevitejs
cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:*before 0.1.24VulnerableVoidzero
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* Versions before 6.4.3; 7.0.0 to before 7.3.5; 8.0.0 to before 8.0.16 Vulnerable ·vitejs
  • cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:* Versions before 0.1.24 Vulnerable ·Voidzero
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA vite (vitejs) Fixed in 8.0.16, 7.3.5, 6.4.3
  • Fix · GHSA-fx2h-pf6j-xcff vite (npm) Fixed in 8.0.16 Advisory →
  • Fix · GHSA-fx2h-pf6j-xcff vite (npm) Fixed in 7.3.5 Advisory →
  • Fix · GHSA-fx2h-pf6j-xcff vite (npm) Fixed in 6.4.3 Advisory →
  • Fix · GHSA-fx2h-pf6j-xcff vite-plus (npm) Fixed in 0.1.24 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53571
  2. 2026-10-03 Alias added: GHSA-fx2h-pf6j-xcff

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
  • TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
  • TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
  • TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
  • TI-2026-28352 Vite has a Path Traversal in Optimized Deps `.map` Handling CVSS 4.0MEDIUM 6.3
  • TI-2026-28351 Vite has a `server.fs.deny` bypass with queries CVSS 4.0HIGH 8.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences