CVE-2025-46565: Vitejs Vite Path Traversal Vulnerability

CVE-2025-46565 Overview

CVE-2025-46565 is a path traversal vulnerability [CWE-22] in Vite, a widely used JavaScript frontend tooling framework maintained by the vitejs project. The flaw allows remote attackers to read files inside the project root that should be blocked by the server.fs.deny file matching pattern. Attackers bypass the deny list by using a combination of a slash and dot (/.) in the request path. The issue affects only applications that explicitly expose the Vite dev server to the network through the --host flag or the server.host configuration option. Fixed versions include 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive files such as .env, .env.*, and *.{crt,pem} from the project root of network-exposed Vite dev servers, leaking secrets and private keys.

Affected Products

Vite versions prior to 4.5.14 (4.x branch)
Vite versions prior to 5.4.19 (5.x branch)
Vite versions prior to 6.1.6, 6.2.7, and 6.3.4 (6.x branch)

Discovery Timeline

2025-05-01 - CVE-2025-46565 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46565

Vulnerability Analysis

Vite ships with a server.fs.deny configuration option that blocks the dev server from serving specific files matched by glob patterns. Default patterns include .env, .env.*, and *.{crt,pem} to prevent accidental exposure of secrets and certificates. The dev server enforces these patterns through a serving access check before returning file contents to the browser.

The vulnerability stems from the deny check being applied inconsistently against normalized paths. When a request path combined a leading slash with a dot (/.), the request bypassed the deny pattern match while still resolving to a real file inside the project root. Only files within root covered by a deny pattern are exposed; files outside root remain protected by separate server.fs.allow logic.

Root Cause

The root cause is a path canonicalization mismatch between the file matching logic in the transform middleware and the static file serving layer backed by sirv. The pre-patch code called ensureServingAccess, which did not fully validate every request path variant. The maintainers refactored the check to route through checkServingAccess and respondWithAccessDenied inside the static middleware, ensuring the same deny logic executes for both transformed requests and direct static reads.

Attack Vector

Exploitation requires network reachability to a Vite dev server started with --host or with server.host set to a non-loopback address. The attacker sends an HTTP GET request containing a crafted /. sequence targeting a file such as .env in the project root. The dev server returns the file contents in the response body without authentication.

typescript

// Patch excerpt from packages/vite/src/node/server/middlewares/transform.ts
   ERR_OUTDATED_OPTIMIZED_DEP,
   NULL_BYTE_PLACEHOLDER,
 } from '../../../shared/constants'
-import { ensureServingAccess } from './static'
+import { checkServingAccess, respondWithAccessDenied } from './static'
 
 const debugCache = createDebugger('vite:cache')

Source: vitejs/vite commit c22c43de. The patch replaces the single ensureServingAccess helper with an explicit two-step check that validates access and issues a proper denied response through the shared sirv static handler.

Detection Methods for CVE-2025-46565

Indicators of Compromise

HTTP requests to a Vite dev server containing /. sequences targeting sensitive filenames such as /.env, /.env.local, or *.pem.
Dev server access logs showing 200 responses for files that should be denied by server.fs.deny patterns.
Unexpected outbound connections from developer workstations or CI runners exposing port 5173 or a custom Vite port.

Detection Strategies

Inventory running Node.js processes for vite and compare installed versions against the fixed releases 4.5.14, 5.4.19, 6.1.6, 6.2.7, and 6.3.4.
Scan repository lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) for vulnerable Vite versions across development and CI environments.
Review dev server startup configuration for the --host flag or a non-loopback server.host value that exposes the service beyond localhost.

Monitoring Recommendations

Alert on any developer workstation binding a Vite port to 0.0.0.0 or a routable interface on corporate networks.
Log and inspect HTTP request paths hitting dev servers for suspicious traversal patterns such as /., .., or encoded variants.
Monitor egress traffic from developer subnets to detect unauthorized scanning of dev server ports.

How to Mitigate CVE-2025-46565

Immediate Actions Required

Upgrade Vite to 6.3.4, 6.2.7, 6.1.6, 5.4.19, or 4.5.14 depending on the branch in use.
Rotate any secrets stored in .env files and reissue any TLS certificates or private keys located in the project root if the dev server was exposed to untrusted networks.
Audit CI/CD pipelines and preview environments that may run Vite in dev mode with network binding enabled.

Patch Information

The fix is published in the GitHub Security Advisory GHSA-859w-5945-r5v3 and implemented in commit c22c43de. The patch routes serving access checks through the sirv static middleware and adds a dedicated respondWithAccessDenied handler that closes the /. bypass.

Workarounds

Do not use --host or set server.host on production-adjacent networks; keep the Vite dev server bound to localhost until the upgrade is complete.
Place developer machines behind a host firewall that blocks inbound connections to the Vite dev server port.
Move secrets out of the project root and load them from a location outside the served directory tree.

bash

# Upgrade Vite to a patched release using your package manager
npm install vite@6.3.4 --save-dev
# or, for the 5.x branch
npm install vite@5.4.19 --save-dev
# or, for the 4.x branch
npm install vite@4.5.14 --save-dev

# Verify the installed version
npx vite --version