Skip to content
OpenAdvisories
Low · 2.3 CVE-2025-58752 EUVD-2025-27180GHSA-jqfw-vq24-v9c3

Vite's `server.fs` settings were not applied to HTML files

Published Sep 8, 2025 · Updated Sep 9, 2025 · Assigned by GitHub_M

Vendor: vitejs Product: vite Package: langfuse-3-compat Package: langfuse-3-worker Package: vite Package: vitess-23 Package: vitess-23-binaries Package: vitess-23-compat Ecosystem: npm Ecosystem: Wolfi

Description

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

Affected products

VendorProductAffectedFixed
vitejs vite < 5.4.20, >= 6.0.0, < 6.3.6, >= 7.0.0, < 7.0.7, >= 7.1.0, < 7.1.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling langfuse-3-compat 3.225.7-r6 —
Wolfi rolling langfuse-3-worker 3.179.1-r3 —
Wolfi rolling vitess-23 +2 23.0.0-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm vite >= 7.1.0, < 7.1.5 7.1.5 GHSA-jqfw-vq24-v9c3
npm vite >= 7.0.0, < 7.0.7 7.0.7 GHSA-jqfw-vq24-v9c3
npm vite >= 6.0.0, < 6.3.6 6.3.6 GHSA-jqfw-vq24-v9c3
npm vite < 5.4.20 5.4.20 GHSA-jqfw-vq24-v9c3

Advisories 3

References