CVE-2025-46565: Vite Vite's Server.fs.deny Bypassed With /. Vulnerability
MODERATECVE-2025-46565 is a MODERATE vite's server.fs.deny bypassed with /. vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Vite libraries in the npm ecosystem. The issue involves vite's server.fs.deny bypassed with /. for files under project root. Remediation is available by upgrading affected packages to version 6.3.4, 6.2.7, 6.1.6, 5.4.19, 4.5.14.
CVE-2025-46565 at a Glance
How to Fix CVE-2025-46565
To remediate this vulnerability, upgrade all affected Vite dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install vite@6.3.4npm install vite@6.2.7npm install vite@6.1.6npm install vite@5.4.19npm install vite@4.5.14Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls viteHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-46565, inspect your project dependencies using npm:
npm ls viteAnalyze the terminal output to locate any version of Vite in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.3.4), your application is affected.
Note: The npm ls vite command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Vite, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-46565 Affected Vite Versions
5 component(s)References
Frequently Asked Questions
What is CVE-2025-46565?
Which Vite versions are affected?
What version fixes CVE-2025-46565?
Is vite affected?
What CWE is associated with CVE-2025-46565?
How can I check npm dependencies for CVE-2025-46565?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-859w-5945-r5v3",
"modified" : "2025-05-02T15:33:47Z",
"published" : "2025-04-30T17:40:27Z",
"aliases" : [ "CVE-2025-46565" ],
"summary" : "Vite's server.fs.deny bypassed with /. for files under project root",
"details" : "### Summary\nThe contents of files in [the project `root`](https://vite.dev/config/shared-options.html#root) that are denied by a file matching pattern can be returned to the browser.\n\n### Impact\n\nOnly apps explicitly exposing the Vite dev server to the network (using --host or [server.host config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\nOnly files that are under [project `root`](https://vite.dev/config/shared-options.html#root) and are denied by a file matching pattern can be bypassed.\n\n- Examples of file matching patterns: `.env`, `.env.*`, `*.{crt,pem}`, `**/.env`\n- Examples of other patterns: `**/.git/**`, `.git/**`, `.git/**/*`\n\n### Details\n[`server.fs.deny`](https://vite.dev/config/server-options.html#server-fs-deny) can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns).\nThese patterns were able to bypass for files under `root` by using a combination of slash and dot (`/.`).\n\n### PoC\n```\nnpm create vite@latest\ncd vite-project/\ncat \"secret\" > .env\nnpm install\nnpm run dev\ncurl --request-target /.env/. http://localhost:5173\n```\n\n\n",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "vite"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.3.0"
}, {
"fixed" : "6.3.4"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 6.3.3"
}
}, {
"package" : {
"ecosystem" : "npm",
"name" : "vite"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.2.0"
}, {
"fixed" : "6.2.7"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 6.2.6"
}
}, {
"package" : {
"ecosystem" : "npm",
"name" : "vite"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.0.0"
}, {
"fixed" : "6.1.6"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 6.1.5"
}
}, {
"package" : {
"ecosystem" : "npm",
"name" : "vite"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0"
}, {
"fixed" : "5.4.19"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 5.4.18"
}
}, {
"package" : {
"ecosystem" : "npm",
"name" : "vite"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.5.14"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.5.13"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-46565"
}, {
"type" : "WEB",
"url" : "https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/vitejs/vite"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-04-30T17:40:27Z",
"nvd_published_at" : "2025-05-01T18:15:57Z"
}
}