CVE-2025-62522: Vite Path Traversal Vulnerability

CVE-2025-62522 Overview

CVE-2025-62522 is a path traversal vulnerability [CWE-22] in Vite, a frontend tooling framework for JavaScript. The Vite development server on Windows served files that should have been blocked by the server.fs.deny allowlist when a request URL ended with a backslash (\). Attackers who can reach a Vite dev server exposed to the network can retrieve denied files that developers assumed were protected. Only applications that explicitly expose the Vite dev server to the network and run it on Windows are affected. Patched releases are 5.4.21, 6.4.1, 7.0.8, and 7.1.11.

Critical Impact
Remote unauthenticated attackers can bypass server.fs.deny restrictions and read files intended to be blocked, such as source configuration or secrets referenced by the project.

Affected Products

Vite 2.9.18 up to (but not including) 3.0.0, and 3.2.9 up to 4.0.0
Vite 4.5.3 up to 5.0.0, and 5.2.6 up to 5.4.21
Vite 6.0.0 up to 6.4.1, 7.0.0 up to 7.0.8, and 7.1.0 up to 7.1.11

Discovery Timeline

2025-10-20 - CVE-2025-62522 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62522

Vulnerability Analysis

Vite's dev server enforces file access controls through the server.fs.deny glob list, which is checked in packages/vite/src/node/server/middlewares/static.ts. On Windows, when a request URL ended with a backslash, the resolved file path also carried a trailing separator. The deny-glob check compared that trailing-separator path against the deny patterns and failed to match, allowing the request to proceed. Node's fs.readFile on Windows normalizes the trailing separator and returns the underlying file content, which delivers the denied file to the requester.

Root Cause

The root cause is inconsistent path normalization between the security check and the file-read operation. The config.fsDenyGlob(filePath) comparison did not strip a trailing slash, so glob patterns intended to block files such as .env did not match .env\. The underlying filesystem call still resolved and read the original file, producing a mismatch classic to CWE-22 path traversal weaknesses.

Attack Vector

Exploitation requires network reachability to a Vite dev server started with --host (or equivalent) on Windows. The attacker issues an HTTP request for a path that would normally be denied and appends a trailing backslash. No authentication or user interaction on the target host is required. The impact is limited to confidentiality of files reachable from the dev server's working tree.

typescript

// Security patch in packages/vite/src/node/server/middlewares/static.ts
// fix(dev): trim trailing slash before `server.fs.deny` check (#20968)

  if (!fs.strict) return true

-  if (config.fsDenyGlob(filePath)) return false
+  // NOTE: `fs.readFile('/foo.png/')` tries to load `'/foo.png'`
+  // so we should check the path without trailing slash
+  const filePathWithoutTrailingSlash = filePath.endsWith('/')
+    ? filePath.slice(0, -1)
+    : filePath
+  if (config.fsDenyGlob(filePathWithoutTrailingSlash)) return false

  if (config.safeModulePaths.has(filePath)) return true

Source: vitejs/vite commit f479cc5

Detection Methods for CVE-2025-62522

Indicators of Compromise

HTTP requests to a Vite dev server where the URL path ends with \ or its encoded form %5C, particularly targeting sensitive names such as .env, .git/config, or files under project roots.
Access log entries returning 200 OK for paths that ordinarily produce a 403 from the server.fs.deny middleware.
Outbound scanning against internal Windows development hosts on common Vite ports (5173, 4173).

Detection Strategies

Inspect reverse-proxy or web-server logs for request paths ending with \ or %5C reaching Node.js dev processes on Windows.
Correlate process telemetry showing node.exe running vite with inbound connections from non-loopback source addresses.
Alert on file-read events by the Vite process against paths listed in server.fs.deny (for example .env, .git/) during dev-server sessions.

Monitoring Recommendations

Baseline which developer workstations run Vite with --host exposure and flag deviations.
Ingest dev-server access logs into a central log store and search for trailing-separator patterns.
Monitor for successful reads of dotfiles under project directories by Node processes.

How to Mitigate CVE-2025-62522

Immediate Actions Required

Upgrade Vite to 5.4.21, 6.4.1, 7.0.8, or 7.1.11 depending on the major version in use.
Audit developer machines running Vite on Windows for exposure of ports 5173 or 4173 to non-loopback interfaces.
Rotate any secrets that were referenced by .env files or other deny-listed resources on exposed hosts.

Patch Information

The fix is applied in packages/vite/src/node/server/middlewares/static.ts and trims a trailing / from the resolved filePath before evaluating config.fsDenyGlob. Details are documented in the Vite GHSA-93m4-6634-74q7 advisory and the upstream commit.

Workarounds

Bind the Vite dev server to localhost only and avoid --host or server.host: true in vite.config.*.
Place the dev server behind a reverse proxy that rejects request paths ending with \ or %5C.
Prevent the dev server from starting outside developer workstations by restricting NODE_ENV=development builds in CI.

bash

# Configuration example: restrict Vite dev server to loopback in vite.config.ts
# server:
#   host: '127.0.0.1'
#   strictPort: true

# Upgrade to a patched release
npm install vite@7.1.11 --save-dev
# or, for other supported majors
npm install vite@7.0.8  --save-dev
npm install vite@6.4.1  --save-dev
npm install vite@5.4.21 --save-dev