# CVE-2025-32395: Vite server.fs.deny bypass via invalid request-target

Source: https://junglewise.ai/threats/cve-2025-32395-vite-server-fs-deny-bypass-via-invalid-request-target  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-11. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-32395 · Severity: medium · CVSS 4 · Published 2025-04-11

Vite, a popular frontend development tool, contains a vulnerability that allows unauthorized access to files on a developer's machine. If a developer has configured the Vite development server to be accessible over a network, an attacker could remotely read sensitive files like system passwords or configuration files. This issue specifically affects developers using Node.js or Bun as their runtime environment.

Technologies: [Vite](https://junglewise.ai/threats/technologies/vite). Vendors: [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2025-32395 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-32395 being exploited in the wild.

**How severe is CVE-2025-32395?** Medium severity, with a CVSS score of 4, published 11 April 2025.

**Which products and versions are affected?** Vite < 4.5.13, >= 5.0.0, < 5.4.18, >= 6.0.0, < 6.0.15, >= 6.1.0, < 6.1.5, >= 6.2.0, < 6.2.6.

**Is there a fix for CVE-2025-32395?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-32395 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-32395?** Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal and security bypass vulnerability exists in the Vite development server's handling of HTTP request targets. The Vite server failed to properly account for the '#' character in the request URL when validating paths against the 'server.fs.deny' configuration. While the HTTP/1.1 and HTTP/2 specifications generally prohibit '#' in the request-target, runtimes like Node.js and Bun pass these invalid targets to the application layer without rejection. An attacker can craft a request using an invalid target (e.g., including '/#/../../') to bypass filesystem restrictions and read arbitrary files from the host. This vulnerability affects Vite dev servers explicitly exposed to the network (via --host) running on Node or Bun; Deno is not affected as it handles the URL differently. The issue is fixed in versions 4.5.13, 5.4.18, 6.0.15, 6.1.5, and 6.2.6.

## Affected products

- vitejs vite < 4.5.13, >= 5.0.0, < 5.4.18, >= 6.0.0, < 6.0.15, >= 6.1.0, < 6.1.5, >= 6.2.0, < 6.2.6

## Identifiers

- CVE-2025-32395
- GHSA-356w-63v5-8wf4

## Timeline

- 2025-04-10: advisory
- 2025-04-11: disclosed

## References

- [https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4](https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4)
- [https://github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70](https://github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70)
- [https://github.com/vitejs/vite](https://github.com/vitejs/vite)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vitejs launch-editor NTLM hash disclosure via UNC path handling](https://junglewise.ai/threats/cve-2026-53632-vitejs-launch-editor-ntlm-hash-disclosure-via-unc-path-handling)
- [Vite path traversal and sensitive file disclosure on Windows via NTFS ADS](https://junglewise.ai/threats/cve-2026-53571-vite-path-traversal-and-sensitive-file-disclosure-on-windows-via)