CVE-2025-59427: Cloudflare Vite plugin information disclosure via dev server

CVE-2025-59427 · Severity: medium · CVSS 4 · Published 2025-07-08

The Cloudflare Vite plugin, used by developers building Cloudflare Workers applications, serves all project files—including sensitive configuration files like .env and .dev.vars—via its built-in development server by default. If a developer exposes this dev server on a public network (either intentionally or accidentally via tools like cloudflared tunnels), attackers on that network can directly access secret credentials and internal documentation, potentially gaining unauthorized access to cloud services and third-party APIs.

Vendors: Cloudflare, npm.

Quick answers

Is CVE-2025-59427 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59427 being exploited in the wild.
How severe is CVE-2025-59427?
Medium severity, with a CVSS score of 4, published 8 July 2025.
Which products and versions are affected?
Cloudflare Vite-Plugin <1.6.0; @cloudflare/vite-plugin (npm) SEMVER:introduced=0,fixed=1.6.0.
Is there a fix for CVE-2025-59427?
Yes. @cloudflare/vite-plugin (npm): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59427 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-59427?
Check whether you run Cloudflare Vite-Plugin or @cloudflare/vite-plugin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @cloudflare/vite-plugin (npm): upgrade to 1.6.0 or later
    npm install @cloudflare/vite-plugin@1.6.0

Technical details

This is an information disclosure vulnerability (CWE-200) in the Cloudflare Vite plugin where the development server's static file serving is misconfigured. The root cause is that Vite's default configuration serves files from the project root directory, not just from the assets directory; the plugin does not restrict access to sensitive files like .env, .dev.vars, and .dev.vars.* variants. An unauthenticated attacker with network access to the dev server (accessible locally, on a shared network, or via a public tunnel like cloudflared) can trivially enumerate and retrieve these files via HTTP GET requests (e.g., curl http://target:5173/.env). The attack requires no authentication, user interaction, or special preconditions beyond network reachability. Successful exploitation discloses API keys, database credentials, and other secrets that enable lateral movement and unauthorized cloud service access. The vulnerability affects all versions prior to 1.6.0; the fix restricts access to .dev.vars files in the dev and preview servers.

Affected products

  • Cloudflare @cloudflare/vite-plugin <1.6.0

Identifiers

  • CVE-2025-59427
  • GHSA-4pfg-2mw5-f8jx

Timeline

  • 2025-07-08: disclosed
  • 2025-06-11: patched: Patch commit dated 2025-06-11; version 1.6.0 released with fix
  • 2025-07-08: advisory: GHSA-4pfg-2mw5-f8jx published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.