Skip to content
OpenAdvisories

Package · npm

vite

29 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.0
    CVE-2025-32395 Public exploit

    Vite has an `server.fs.deny` bypass with an invalid `request-target`

    Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in re…

    vitejs vite vite npm
  • Medium 5.3
    CVE-2025-31486 Public exploit EPSS 40%

    Vite allows server.fs.deny to be bypassed with .svg or relative paths

    Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only…

    vitejs vite vite npm
  • Medium 5.3
    CVE-2025-31125 Exploited Public exploit EPSS 75%

    Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

    Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This…

    vitejs vite vite npm
    KEV Jan 22, 2026
  • Medium 5.3
    CVE-2025-30208 Public exploit EPSS 75%

    Vite bypasses server.fs.deny when using `?raw??`

    Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this l…

    vitejs vite vite npm