CVE-2025-32395: Vite server.fs.deny bypass via invalid request-target

CVE-2025-32395 · Severity: medium · CVSS 4 · Published 2025-04-11

Vite, a popular frontend development tool, contains a vulnerability that allows unauthorized access to files on a developer's machine. If a developer has configured the Vite development server to be accessible over a network, an attacker could remotely read sensitive files like system passwords or configuration files. This issue specifically affects developers using Node.js or Bun as their runtime environment.

Technologies: Vite. Vendors: Vite.

Quick answers

Is CVE-2025-32395 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-32395 being exploited in the wild.
How severe is CVE-2025-32395?
Medium severity, with a CVSS score of 4, published 11 April 2025.
Which products and versions are affected?
Vite < 4.5.13, >= 5.0.0, < 5.4.18, >= 6.0.0, < 6.0.15, >= 6.1.0, < 6.1.5, >= 6.2.0, < 6.2.6.
Is there a fix for CVE-2025-32395?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-32395 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-32395?
Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal and security bypass vulnerability exists in the Vite development server's handling of HTTP request targets. The Vite server failed to properly account for the '#' character in the request URL when validating paths against the 'server.fs.deny' configuration. While the HTTP/1.1 and HTTP/2 specifications generally prohibit '#' in the request-target, runtimes like Node.js and Bun pass these invalid targets to the application layer without rejection. An attacker can craft a request using an invalid target (e.g., including '/#/../../') to bypass filesystem restrictions and read arbitrary files from the host. This vulnerability affects Vite dev servers explicitly exposed to the network (via --host) running on Node or Bun; Deno is not affected as it handles the URL differently. The issue is fixed in versions 4.5.13, 5.4.18, 6.0.15, 6.1.5, and 6.2.6.

Affected products

  • vitejs vite < 4.5.13, >= 5.0.0, < 5.4.18, >= 6.0.0, < 6.0.15, >= 6.1.0, < 6.1.5, >= 6.2.0, < 6.2.6

Identifiers

  • CVE-2025-32395
  • GHSA-356w-63v5-8wf4

Timeline

  • 2025-04-10: advisory
  • 2025-04-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.