Vite's server.fs.deny bypassed with /. for files under project root

Description

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 4.5.13

  >= 5.0.0, <= 5.4.18

  >= 6.0.0, <= 6.1.5

  >= 6.2.0, <= 6.2.6

  >= 6.3.0, <= 6.3.3**

• Patched version(s): **4.5.14

  5.4.19

  6.1.6

  6.2.7

  6.3.4**

References

• GHSA-859w-5945-r5v3
• CVE-2025-46565
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Vite allows server.fs.deny to be bypassed with .svg or relative paths - CVE-2025-31486
• Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query - CVE-2025-31125
• Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem - CVE-2024-23331
• vite allows server.fs.deny bypass via backslash on Windows - CVE-2025-62522

Tags:

npm

vite