CVE-2025-62522
vite allows server.fs.deny bypass via backslash on Windows
Impact
### Summary Files denied by [`server.fs.deny`](https://vitejs.dev/config/server-options.html#server-fs-deny) were sent if the URL ended with `\` when the dev server is running on Windows. ### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using --host or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - running the dev server on Windows ### Details `server.fs.deny` can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns). These patterns were able to bypass by using a back slash(`\`). The root cause is that `fs.readFile('/foo.png/')` loads `/foo.png`. ### PoC ```shell npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env\ http://localhost:5173 ``` <img width="1593" height="616" alt="image" src="https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175" />
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | vite | >= 7.1.0, <= 7.1.10 | 7.1.11 |
Affected products
| Product | Affected versions |
|---|---|
| Versions From 2.9.18 To | before 3.0.0 |
| 3.2.9 To | before 4.0.0 |
| 4.5.3 To | before 5.0.0 |
| 5.2.6 To | before 5.4.21 |
| 6.0.0 To | before 6.4.1 |
| 7.0.0 To | before 7.0.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.