Vite's server.fs.deny bypassed with /. for files under project root

Description

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 4.5.13

  >= 5.0.0, <= 5.4.18

  >= 6.0.0, <= 6.1.5

  >= 6.2.0, <= 6.2.6

  >= 6.3.0, <= 6.3.3**

• Patched version(s): **4.5.14

  5.4.19

  6.1.6

  6.2.7

  6.3.4**

References

• GHSA-859w-5945-r5v3
• CVE-2025-46565
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
• Vite middleware may serve files starting with the same name with the public directory - CVE-2025-58751
• Vite's `server.fs` settings were not applied to HTML files - CVE-2025-58752
• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881

Tags:

npm

vite