CVE-2025-46565
Description
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
How to fix
- vitejs vite4.5.14, 5.4.19, 6.1.6, 6.2.7, 6.3.4 or later
- vite6.3.4, 6.2.7, 6.1.6, 5.4.19, 4.5.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vitejs vite | v < 4.5.14, 5.0.0 ≤ v < 5.4.19, 6.0.0 ≤ v < 6.1.6, 6.2.0 ≤ v < 6.2.7, 6.3.0 ≤ v < 6.3.4 | 4.5.14, 5.4.19, 6.1.6, 6.2.7, 6.3.4 |
| vitenpm | 6.3.0 ≤ v < 6.3.4, 6.2.0 ≤ v < 6.2.7, 6.0.0 ≤ v < 6.1.6, 5.0.0 ≤ v < 5.4.19, v < 4.5.14 | 6.3.4, 6.2.7, 6.1.6, 5.4.19, 4.5.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.