vite allows server.fs.deny bypass via backslash on Windows

Description

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.2.6, <= 5.4.20

  >= 4.5.3, < 5.0.0

  >= 3.2.9, < 4.0.0

  >= 2.9.18, < 3.0.0

  >= 6.0.0, <= 6.4.0

  >= 7.0.0, <= 7.0.7

  >= 7.1.0, <= 7.1.10**

• Patched version(s): **5.4.21

  6.4.1

  7.0.8

  7.1.11**

References

• GHSA-93m4-6634-74q7
• CVE-2025-62522
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Vite's `server.fs` settings were not applied to HTML files - CVE-2025-58752
• Astro's `X-Forwarded-Host` is reflected without validation - CVE-2025-61925
• OpenPGP.js's message signature verification can be spoofed - CVE-2025-47934
• Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565

Tags:

npm

vite