CVE-2025-32395

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-32395
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32395.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32395
Aliases
Related
Published
2025-04-10T13:25:19Z
Modified
2025-10-22T18:46:13.757141Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vite has an `server.fs.deny` bypass with an invalid `request-target`
Details

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) and running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun) are affected. This vulnerability is fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/vitejs/vite

Affected ranges

Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
d8461b5b4f2884105bab2175b86af4aac521cb5c
Fixed
d3dbf25fd5e21448f9ea6cec8fb5ac45d220037b
Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
051370a332df99d107365ed6beab418ef017eff6
Fixed
c279023cc3b3fed9cfcb43938cd452aa9ce11995
Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
814120f2ad387ca3d1e16c7dd403b04ca4b97f75
Fixed
e3504684e873e2319f3c8ce1fc0d1b5c0724fbdf
Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
0c3125833033fec4356ab4e90e806e02e8644c40
Fixed
731b77d19d36f5682a5441b49cb2f6473389ad99
Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cd60e8bb2e354ca03d2e5e5b0d0a151cf40698e2

Affected versions

create-app@1.*

create-app@1.0.0
create-app@1.0.1
create-app@1.0.2
create-app@1.0.3
create-app@1.0.4
create-app@1.0.5
create-app@1.0.6
create-app@1.1.0
create-app@1.3.0
create-app@1.4.0
create-app@1.5.0
create-app@1.5.1
create-app@1.5.2
create-app@1.6.0
create-app@1.7.0
create-app@1.7.1
create-app@1.8.0

create-app@2.*

create-app@2.0.0
create-app@2.0.1
create-app@2.0.2
create-app@2.1.0
create-app@2.2.0
create-app@2.2.1
create-app@2.2.2
create-app@2.2.3
create-app@2.2.4
create-app@2.2.5
create-app@2.3.0
create-app@2.3.1
create-app@2.3.2
create-app@2.4.0
create-app@2.4.1
create-app@2.4.2
create-app@2.4.3
create-app@2.4.4
create-app@2.4.5

create-vite@2.*

create-vite@2.5.0
create-vite@2.5.1
create-vite@2.5.2
create-vite@2.5.3
create-vite@2.5.4
create-vite@2.6.1
create-vite@2.6.2
create-vite@2.6.3
create-vite@2.6.4
create-vite@2.6.5
create-vite@2.6.6
create-vite@2.7.0
create-vite@2.7.1
create-vite@2.7.2
create-vite@2.8.0
create-vite@2.9.0
create-vite@2.9.1
create-vite@2.9.2
create-vite@2.9.3

create-vite@3.*

create-vite@3.0.0
create-vite@3.0.1
create-vite@3.0.2
create-vite@3.1.0
create-vite@3.2.0
create-vite@3.2.1

create-vite@4.*

create-vite@4.0.0
create-vite@4.0.0-beta.0
create-vite@4.1.0
create-vite@4.1.0-beta.0
create-vite@4.2.0
create-vite@4.2.0-beta.0
create-vite@4.2.0-beta.1
create-vite@4.3.0
create-vite@4.3.0-beta.0
create-vite@4.3.1
create-vite@4.3.2
create-vite@4.4.0
create-vite@4.4.1

create-vite@5.*

create-vite@5.0.0
create-vite@5.1.0
create-vite@5.2.0
create-vite@5.2.1
create-vite@5.2.2
create-vite@5.2.3
create-vite@5.3.0
create-vite@5.4.0
create-vite@5.5.0
create-vite@5.5.1
create-vite@5.5.2

create-vite@6.*

create-vite@6.0.0
create-vite@6.0.1
create-vite@6.1.0
create-vite@6.1.1
create-vite@6.2.0
create-vite@6.2.1
create-vite@6.3.0
create-vite@6.3.1

plugin-legacy@1.*

plugin-legacy@1.0.0
plugin-legacy@1.0.1
plugin-legacy@1.1.0
plugin-legacy@1.1.1
plugin-legacy@1.2.0
plugin-legacy@1.2.1
plugin-legacy@1.2.2
plugin-legacy@1.2.3
plugin-legacy@1.3.0
plugin-legacy@1.3.1
plugin-legacy@1.3.2
plugin-legacy@1.3.3
plugin-legacy@1.3.4
plugin-legacy@1.4.0
plugin-legacy@1.4.1
plugin-legacy@1.4.2
plugin-legacy@1.4.3
plugin-legacy@1.4.4
plugin-legacy@1.5.0
plugin-legacy@1.5.1
plugin-legacy@1.5.2
plugin-legacy@1.5.3
plugin-legacy@1.6.0
plugin-legacy@1.6.1
plugin-legacy@1.6.2
plugin-legacy@1.6.3
plugin-legacy@1.6.4
plugin-legacy@1.7.0
plugin-legacy@1.8.0
plugin-legacy@1.8.1
plugin-legacy@1.8.2

plugin-legacy@2.*

plugin-legacy@2.0.0
plugin-legacy@2.0.0-alpha.0
plugin-legacy@2.0.0-alpha.1
plugin-legacy@2.0.0-alpha.2
plugin-legacy@2.0.0-beta.0
plugin-legacy@2.0.0-beta.1
plugin-legacy@2.0.1
plugin-legacy@2.1.0
plugin-legacy@2.1.0-beta.0
plugin-legacy@2.2.0
plugin-legacy@2.3.0
plugin-legacy@2.3.0-beta.0
plugin-legacy@2.3.1

plugin-legacy@3.*

plugin-legacy@3.0.0
plugin-legacy@3.0.0-alpha.0
plugin-legacy@3.0.1

plugin-legacy@4.*

plugin-legacy@4.0.0
plugin-legacy@4.0.1
plugin-legacy@4.0.2
plugin-legacy@4.0.3
plugin-legacy@4.0.4
plugin-legacy@4.0.5
plugin-legacy@4.1.0
plugin-legacy@4.1.1

plugin-legacy@5.*

plugin-legacy@5.0.0
plugin-legacy@5.1.0
plugin-legacy@5.2.0
plugin-legacy@5.3.0
plugin-legacy@5.3.1
plugin-legacy@5.3.2
plugin-legacy@5.4.0
plugin-legacy@5.4.1
plugin-legacy@5.4.2

plugin-legacy@6.*

plugin-legacy@6.0.0
plugin-legacy@6.0.1
plugin-legacy@6.0.2

plugin-react-refresh@1.*

plugin-react-refresh@1.1.0
plugin-react-refresh@1.1.1
plugin-react-refresh@1.1.2
plugin-react-refresh@1.1.3
plugin-react-refresh@1.2.0
plugin-react-refresh@1.2.1
plugin-react-refresh@1.2.2
plugin-react-refresh@1.3.0
plugin-react-refresh@1.3.1
plugin-react-refresh@1.3.2
plugin-react-refresh@1.3.3
plugin-react-refresh@1.3.4
plugin-react-refresh@1.3.5
plugin-react-refresh@1.3.6

plugin-react@1.*

plugin-react@1.0.0
plugin-react@1.0.0-beta.0
plugin-react@1.0.1
plugin-react@1.0.2
plugin-react@1.0.3
plugin-react@1.0.4
plugin-react@1.0.5
plugin-react@1.0.6
plugin-react@1.1.0
plugin-react@1.1.0-beta.0
plugin-react@1.1.0-beta.1
plugin-react@1.1.1
plugin-react@1.1.2
plugin-react@1.1.3
plugin-react@1.1.4
plugin-react@1.2.0
plugin-react@1.3.0
plugin-react@1.3.1
plugin-react@1.3.2

plugin-react@2.*

plugin-react@2.0.0
plugin-react@2.0.0-alpha.0
plugin-react@2.0.0-alpha.1
plugin-react@2.0.0-alpha.2
plugin-react@2.0.0-alpha.3
plugin-react@2.0.0-beta.0
plugin-react@2.0.0-beta.1
plugin-react@2.0.1
plugin-react@2.1.0
plugin-react@2.1.0-beta.0
plugin-react@2.2.0
plugin-react@2.2.0-beta.0

plugin-react@3.*

plugin-react@3.0.0-alpha.0
plugin-react@3.0.0-alpha.1
plugin-react@3.0.0-alpha.2

plugin-vue-jsx@1.*

plugin-vue-jsx@1.0.0
plugin-vue-jsx@1.0.1
plugin-vue-jsx@1.0.2
plugin-vue-jsx@1.0.3
plugin-vue-jsx@1.1.0
plugin-vue-jsx@1.1.1
plugin-vue-jsx@1.1.2
plugin-vue-jsx@1.1.3
plugin-vue-jsx@1.1.4
plugin-vue-jsx@1.1.5
plugin-vue-jsx@1.1.6
plugin-vue-jsx@1.1.7
plugin-vue-jsx@1.1.8
plugin-vue-jsx@1.2.0
plugin-vue-jsx@1.3.0
plugin-vue-jsx@1.3.0-beta.0
plugin-vue-jsx@1.3.1
plugin-vue-jsx@1.3.10
plugin-vue-jsx@1.3.2
plugin-vue-jsx@1.3.3
plugin-vue-jsx@1.3.4
plugin-vue-jsx@1.3.6
plugin-vue-jsx@1.3.7
plugin-vue-jsx@1.3.8
plugin-vue-jsx@1.3.9

plugin-vue-jsx@2.*

plugin-vue-jsx@2.0.0
plugin-vue-jsx@2.0.0-alpha.0
plugin-vue-jsx@2.0.0-alpha.1
plugin-vue-jsx@2.0.0-beta.0
plugin-vue-jsx@2.0.1
plugin-vue-jsx@2.1.0
plugin-vue-jsx@2.1.0-beta.0
plugin-vue-jsx@2.1.1

plugin-vue-jsx@3.*

plugin-vue-jsx@3.0.0-alpha.0

plugin-vue@1.*

plugin-vue@1.0.3
plugin-vue@1.0.4
plugin-vue@1.0.5
plugin-vue@1.0.6
plugin-vue@1.1.0
plugin-vue@1.1.1
plugin-vue@1.1.2
plugin-vue@1.1.3
plugin-vue@1.1.4
plugin-vue@1.1.5
plugin-vue@1.10.0
plugin-vue@1.10.0-beta.0
plugin-vue@1.10.0-beta.1
plugin-vue@1.10.1
plugin-vue@1.10.2
plugin-vue@1.2.0
plugin-vue@1.2.1
plugin-vue@1.2.2
plugin-vue@1.2.3
plugin-vue@1.2.4
plugin-vue@1.2.5
plugin-vue@1.3.0
plugin-vue@1.4.0
plugin-vue@1.5.0
plugin-vue@1.6.0
plugin-vue@1.6.1
plugin-vue@1.6.2
plugin-vue@1.7.0
plugin-vue@1.7.1
plugin-vue@1.8.0
plugin-vue@1.8.1
plugin-vue@1.9.0
plugin-vue@1.9.1
plugin-vue@1.9.2
plugin-vue@1.9.3
plugin-vue@1.9.4

plugin-vue@2.*

plugin-vue@2.0.0
plugin-vue@2.0.1
plugin-vue@2.1.0
plugin-vue@2.2.0
plugin-vue@2.2.1
plugin-vue@2.2.2
plugin-vue@2.2.3
plugin-vue@2.2.4
plugin-vue@2.3.0
plugin-vue@2.3.0-beta.0
plugin-vue@2.3.1
plugin-vue@2.3.2

plugin-vue@3.*

plugin-vue@3.0.0
plugin-vue@3.0.0-alpha.0
plugin-vue@3.0.0-alpha.1
plugin-vue@3.0.0-alpha.2
plugin-vue@3.0.0-beta.0
plugin-vue@3.0.0-beta.1
plugin-vue@3.0.1
plugin-vue@3.0.2
plugin-vue@3.0.3
plugin-vue@3.1.0
plugin-vue@3.1.0-beta.0
plugin-vue@3.2.0
plugin-vue@3.2.0-beta.0

plugin-vue@4.*

plugin-vue@4.0.0-alpha.0
plugin-vue@4.0.0-alpha.1
plugin-vue@4.0.0-alpha.2

v1.*

v1.0.0-rc.10
v1.0.0-rc.11
v1.0.0-rc.13
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.0-rc.8
v1.0.0-rc.9

v2.*

v2.0.0
v2.0.0-alpha.1
v2.0.0-alpha.2
v2.0.0-alpha.3
v2.0.0-alpha.4
v2.0.0-alpha.5
v2.0.0-beta.1
v2.0.0-beta.10
v2.0.0-beta.11
v2.0.0-beta.12
v2.0.0-beta.13
v2.0.0-beta.14
v2.0.0-beta.15
v2.0.0-beta.16
v2.0.0-beta.17
v2.0.0-beta.18
v2.0.0-beta.19
v2.0.0-beta.2
v2.0.0-beta.20
v2.0.0-beta.21
v2.0.0-beta.22
v2.0.0-beta.23
v2.0.0-beta.24
v2.0.0-beta.25
v2.0.0-beta.26
v2.0.0-beta.27
v2.0.0-beta.28
v2.0.0-beta.29
v2.0.0-beta.3
v2.0.0-beta.30
v2.0.0-beta.31
v2.0.0-beta.32
v2.0.0-beta.33
v2.0.0-beta.34
v2.0.0-beta.35
v2.0.0-beta.37
v2.0.0-beta.38
v2.0.0-beta.39
v2.0.0-beta.4
v2.0.0-beta.40
v2.0.0-beta.41
v2.0.0-beta.42
v2.0.0-beta.43
v2.0.0-beta.44
v2.0.0-beta.45
v2.0.0-beta.46
v2.0.0-beta.47
v2.0.0-beta.48
v2.0.0-beta.49
v2.0.0-beta.5
v2.0.0-beta.50
v2.0.0-beta.51
v2.0.0-beta.52
v2.0.0-beta.53
v2.0.0-beta.54
v2.0.0-beta.55
v2.0.0-beta.56
v2.0.0-beta.57
v2.0.0-beta.58
v2.0.0-beta.59
v2.0.0-beta.6
v2.0.0-beta.60
v2.0.0-beta.61
v2.0.0-beta.62
v2.0.0-beta.63
v2.0.0-beta.64
v2.0.0-beta.65
v2.0.0-beta.66
v2.0.0-beta.67
v2.0.0-beta.68
v2.0.0-beta.69
v2.0.0-beta.7
v2.0.0-beta.70
v2.0.0-beta.8
v2.0.0-beta.9
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.4.0
v2.4.0-beta.0
v2.4.0-beta.1
v2.4.0-beta.2
v2.4.0-beta.3
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.0-beta.0
v2.5.0-beta.1
v2.5.0-beta.2
v2.5.0-beta.3
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5
v2.5.6
v2.5.7
v2.6.0
v2.6.0-beta.0
v2.6.0-beta.1
v2.6.0-beta.2
v2.6.0-beta.3
v2.6.0-beta.4
v2.6.1
v2.6.10
v2.6.11
v2.6.12
v2.6.13
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.6.9
v2.7.0
v2.7.0-beta.0
v2.7.0-beta.1
v2.7.0-beta.10
v2.7.0-beta.11
v2.7.0-beta.2
v2.7.0-beta.3
v2.7.0-beta.4
v2.7.0-beta.5
v2.7.0-beta.6
v2.7.0-beta.7
v2.7.0-beta.8
v2.7.0-beta.9
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.0-beta.0
v2.8.0-beta.1
v2.8.0-beta.2
v2.8.0-beta.3
v2.8.0-beta.4
v2.8.0-beta.5
v2.8.0-beta.6
v2.8.0-beta.7
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.9.0
v2.9.0-beta.0
v2.9.0-beta.1
v2.9.0-beta.10
v2.9.0-beta.11
v2.9.0-beta.2
v2.9.0-beta.3
v2.9.0-beta.4
v2.9.0-beta.5
v2.9.0-beta.6
v2.9.0-beta.7
v2.9.0-beta.8
v2.9.0-beta.9
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v2.9.5
v2.9.6
v2.9.7
v2.9.8

v3.*

v3.0.0
v3.0.0-alpha.0
v3.0.0-alpha.1
v3.0.0-alpha.10
v3.0.0-alpha.11
v3.0.0-alpha.12
v3.0.0-alpha.13
v3.0.0-alpha.14
v3.0.0-alpha.2
v3.0.0-alpha.3
v3.0.0-alpha.4
v3.0.0-alpha.5
v3.0.0-alpha.6
v3.0.0-alpha.7
v3.0.0-alpha.8
v3.0.0-alpha.9
v3.0.0-beta.0
v3.0.0-beta.1
v3.0.0-beta.10
v3.0.0-beta.2
v3.0.0-beta.3
v3.0.0-beta.4
v3.0.0-beta.5
v3.0.0-beta.6
v3.0.0-beta.7
v3.0.0-beta.8
v3.0.0-beta.9
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.0-beta.0
v3.1.0-beta.1
v3.1.0-beta.2
v3.1.1
v3.1.2
v3.1.3
v3.2.0
v3.2.0-beta.0
v3.2.0-beta.1
v3.2.0-beta.2
v3.2.0-beta.3
v3.2.0-beta.4
v3.2.1
v3.2.2
v3.2.3

v4.*

v4.0.0
v4.0.0-alpha.0
v4.0.0-alpha.1
v4.0.0-alpha.2
v4.0.0-alpha.3
v4.0.0-alpha.4
v4.0.0-alpha.5
v4.0.0-alpha.6
v4.0.0-beta.0
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.0-beta.3
v4.0.0-beta.4
v4.0.0-beta.5
v4.0.0-beta.6
v4.0.0-beta.7
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.1.0-beta.0
v4.1.0-beta.1
v4.1.0-beta.2
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.2.0
v4.2.0-beta.0
v4.2.0-beta.1
v4.2.0-beta.2
v4.2.1
v4.3.0
v4.3.0-beta.0
v4.3.0-beta.1
v4.3.0-beta.2
v4.3.0-beta.3
v4.3.0-beta.4
v4.3.0-beta.5
v4.3.0-beta.6
v4.3.0-beta.7
v4.3.0-beta.8
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.3.8
v4.3.9
v4.4.0
v4.4.0-beta.0
v4.4.0-beta.1
v4.4.0-beta.2
v4.4.0-beta.3
v4.4.0-beta.4
v4.4.1
v4.4.10
v4.4.11
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.4.9
v4.5.0
v4.5.1
v4.5.10
v4.5.11
v4.5.12
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.5.7
v4.5.8
v4.5.9

v5.*

v5.0.0
v5.0.1
v5.0.10
v5.0.11
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9
v5.1.0
v5.1.0-beta.0
v5.1.0-beta.1
v5.1.0-beta.2
v5.1.0-beta.3
v5.1.0-beta.4
v5.1.0-beta.5
v5.1.0-beta.6
v5.1.0-beta.7
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.2.0
v5.2.0-beta.0
v5.2.0-beta.1
v5.2.1
v5.2.10
v5.2.11
v5.2.12
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.2.7
v5.2.8
v5.2.9
v5.3.0
v5.3.0-beta.0
v5.3.0-beta.1
v5.3.0-beta.2
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.3.5
v5.4.0
v5.4.0-beta.0
v5.4.0-beta.1
v5.4.1
v5.4.10
v5.4.11
v5.4.12
v5.4.13
v5.4.14
v5.4.15
v5.4.16
v5.4.17
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.4.6
v5.4.7
v5.4.8
v5.4.9

v6.*

v6.0.0
v6.0.1
v6.0.10
v6.0.11
v6.0.12
v6.0.13
v6.0.14
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v6.0.8
v6.0.9
v6.1.0
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.2.0
v6.2.1
v6.2.2
v6.2.3
v6.2.4
v6.2.5