Description
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vitejs | vite | >= 7.1.0, < 7.1.11, >= 7.0.0, < 7.0.8, >= 6.0.0, < 6.4.1, >= 5.2.6, < 5.4.21, >= 4.5.3, < 5.0.0, >= 3.2.9, < 4.0.0, >= 2.9.18, < 3.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.179.1-r3 | — |
| Wolfi rolling | renovate | 41.156.1-r0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Vite - Information Disclosure http/cves/2025/CVE-2025-62522.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | vite | >= 7.1.0, < 7.1.11 | 7.1.11 | GHSA-93m4-6634-74q7 |
| npm | vite | >= 7.0.0, < 7.0.8 | 7.0.8 | GHSA-93m4-6634-74q7 |
| npm | vite | >= 6.0.0, < 6.4.1 | 6.4.1 | GHSA-93m4-6634-74q7 |
| npm | vite | >= 2.9.18, < 5.4.21 | 5.4.21 | GHSA-93m4-6634-74q7 |
| npm | vite | >= 3.2.9, < 5.4.21 | 5.4.21 | GHSA-93m4-6634-74q7 |
| npm | vite | >= 4.5.3, < 5.4.21 | 5.4.21 | GHSA-93m4-6634-74q7 |
| npm | vite | >= 5.2.6, < 5.4.21 | 5.4.21 | GHSA-93m4-6634-74q7 |
Advisories 3
- ICSA-26-071-03 Siemens SIDIS Prime CISA ICS & IT advisories · Mar 12, 2026
- NCSC-2026-0079 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Mar 10, 2026
- SSA-485750 SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 Siemens ProductCERT · Mar 10, 2026