chore(deps): update dependency vite [security] #9708
Conversation
|
📝 WalkthroughWalkthroughBumped the devDependency Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
|
| Command | Status | Duration | Result |
|---|---|---|---|
nx affected --targets=test:sherif,test:knip,tes... |
❌ Failed | 1m 11s | View ↗ |
nx run-many --target=build --exclude=examples/*... |
❌ Failed | 10s | View ↗ |
☁️ Nx Cloud last updated this comment at 2026-01-11 08:49:28 UTC
|
Sizes for commit 1c5c5da:
|
lachlancollins
force-pushed
the
main
branch
from
993ff9a to
b72a56f
Compare
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
5c81be8 to
c15730d
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
c15730d to
42e2d9c
Compare
renovate
bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
| "typescript": "5.8.3", | ||
| "vite": "^4.5.14", | ||
| "vite": "^5.4.20", | ||
| "vite-plugin-vue2": "2.0.3" |
There was a problem hiding this comment.
Upgrade blocked by Vue 2.6 plugin compatibility
Line 17 moves this example to Vite ^5.4.20 while retaining vite-plugin-vue2@2.0.3, but that plugin’s peer constraint is vite ^2 || ^3, so installation will fail and the tooling won’t run.(npmpeer.dev) Compounding that, the package is in maintenance mode and only supports Vue 2.6 or earlier with no Vite 5-ready release, so we either keep this example on Vite 4 or migrate it to Vue 2.7 plus @vitejs/plugin-vue2 before bumping Vite.(npm.io)
🤖 Prompt for AI Agents
In examples/vue/2.6-basic/package.json around lines 17-19, Vite was bumped to
^5.4.20 but the project still depends on vite-plugin-vue2@2.0.3 which only
supports vite ^2 || ^3 and is not Vite 5 compatible; fix by either (A) pinning
Vite to a Vite-4-compatible version (e.g., ^4.x) so the existing
vite-plugin-vue2 remains valid, or (B) migrate the example to Vue 2.7 and
replace vite-plugin-vue2 with a Vite-5-compatible plugin (e.g.,
@vitejs/plugin-vue2), update package.json and any plugin-related config/code,
then run npm install and smoke-test the dev/build to ensure tooling works.
examples/vue/2.7-basic/package.json
Outdated
| "vite": "^5.4.20", | ||
| "vite-plugin-vue2": "2.0.3" |
There was a problem hiding this comment.
Vite 5 breaks the current Vue 2 build
Line 17 upgrades Vite to ^5.4.20, but the example still depends on vite-plugin-vue2@2.0.3, whose peer dependency caps Vite at ^3.x; npm install/pnpm install will dead-stop with an ERESOLVE failure and the dev server won’t start.(npmpeer.dev) To land Vite 5 you need to swap over to the maintained @vitejs/plugin-vue2 (and update the config imports), because its peer range now covers Vite ^5 alongside Vue 2.7.(github.com)
- "vite": "^5.4.20",
- "vite-plugin-vue2": "2.0.3"
+ "vite": "^5.4.20",
+ "@vitejs/plugin-vue2": "^2.3.3"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "vite": "^5.4.20", | |
| "vite-plugin-vue2": "2.0.3" | |
| "vite": "^5.4.20", | |
| "@vitejs/plugin-vue2": "^2.3.3" |
🤖 Prompt for AI Agents
In examples/vue/2.7-basic/package.json around lines 17-18, the project declares
"vite": "^5.4.20" but still depends on "vite-plugin-vue2": "2.0.3", which has a
peer range limited to Vite ^3 and causes ERESOLVE; replace "vite-plugin-vue2"
with the maintained "@vitejs/plugin-vue2" (use a current compatible version) in
package.json, run install to update lockfile, and then update any Vite
config/imports (e.g., vite.config.js or vite.config.ts) to import and use the
plugin from "@vitejs/plugin-vue2" instead of "vite-plugin-vue2" so the example
works with Vite 5.
42e2d9c to
8d1bd64
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
8d1bd64 to
d00a37c
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
d00a37c to
f89407a
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
f89407a to
b66ddd4
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
b66ddd4 to
ed605e7
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
ed605e7 to
78144d3
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
78144d3 to
ec9eec7
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
ec9eec7 to
01758f7
Compare
renovate
bot
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
examples/vue/2.6-basic/package.json (1)
18-20: Blocker: vite-plugin-vue2 is incompatible with Vite 5+ here; install/build will breakThis example bumps Vite to ^5.4.20 but keeps vite-plugin-vue2@2.0.3 (for Vue 2.6). That plugin’s peer range targets older Vite, so the toolchain won’t resolve or run. Either revert Vite here or migrate the example to Vue 2.7 + @vitejs/plugin-vue2 before taking Vite ≥5.
Minimal safe fix (Option A: keep Vue 2.6):
"devDependencies": { "typescript": "5.8.3", - "vite": "^5.4.20", + "vite": "^4.5.14", "vite-plugin-vue2": "2.0.3" }Preferred fix (Option B: upgrade path):
- Move to Vue 2.7.x and align vue-template-compiler to the same 2.7.x.
- Drop @vue/composition-api (built into 2.7).
- Replace vite-plugin-vue2 with @vitejs/plugin-vue2 and then bump Vite to the target version (see next comment).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
examples/vue/2.6-basic/package.json(1 hunks)examples/vue/2.7-basic/package.json(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- examples/vue/2.7-basic/package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Test
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
01758f7 to
ac77791
Compare
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
2 times, most recently
from
17ed780 to
a08ac38
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
examples/vue/2.7-basic/package.json (1)
17-18: Plugin compatibility blocker (duplicate of previous reviews).As extensively documented in previous review comments,
vite-plugin-vue2@2.0.3peers withvite ^2 || ^3 || ^4and is incompatible with vite ^5.4.21 (or the target ^7.3.0). This causes ERESOLVE errors preventingnpm install.Required: Migrate to
@vitejs/plugin-vue2as detailed in the previous review comments, which includes peer support for Vite 5-7 and provides the necessary vite.config.js configuration.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
examples/vue/2.6-basic/package.jsonexamples/vue/2.7-basic/package.json
🚧 Files skipped from review as they are similar to previous changes (1)
- examples/vue/2.6-basic/package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Preview
- GitHub Check: Test
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
20 times, most recently
from
2e06b1d to
bbad0a6
Compare
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
3 times, most recently
from
4c6cd85 to
bc42c50
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @examples/vue/2.6-basic/package.json:
- Line 18: The package.json currently pins "vite": "^7.3.1" while still using
vite-plugin-vue2 (maintenance-only for Vue ≤2.6) which is incompatible with Vite
7; fix by either downgrading vite to a 6.x release that includes the
CVE-2025-31486 fixes (e.g., any >=6.0.14/6.1.4/6.2.5 per the CVE note) and keep
vite-plugin-vue2 for the 2.6-basic example, or upgrade the plugin to
@vitejs/plugin-vue2 if you intend to target Vite 7 and Vue 2.7+; also update
documentation/PR text to resolve the version discrepancy (6.4.1 vs 7.3.1) and
note Node.js minimums for Vite 7 (Node 20.19+ or 22.12+), and ensure the
CVE-2025-31486 version references are corrected.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
examples/vue/2.6-basic/package.jsonexamples/vue/2.7-basic/package.json
🚧 Files skipped from review as they are similar to previous changes (1)
- examples/vue/2.7-basic/package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Test
- GitHub Check: Preview
examples/vue/2.6-basic/package.json
Outdated
| "devDependencies": { | ||
| "typescript": "5.8.3", | ||
| "vite": "^4.5.14", | ||
| "vite": "^7.3.1", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the stated version change and check for consistency across examples
echo "=== Current vite version in examples/vue/2.6-basic/package.json ==="
cat examples/vue/2.6-basic/package.json | grep -A 2 -B 2 '"vite"'
echo -e "\n=== Checking if examples/vue/2.7-basic exists and its vite version ==="
if [ -f "examples/vue/2.7-basic/package.json" ]; then
cat examples/vue/2.7-basic/package.json | grep -A 2 -B 2 '"vite"'
else
echo "File not found"
fi
echo -e "\n=== All Vue example directories ==="
ls -la examples/vue/ 2>/dev/null || echo "examples/vue not found"
echo -e "\n=== Vite config files in examples ==="
find examples -name "vite.config.*" -type f 2>/dev/null | head -20
echo -e "\n=== Check for vite-plugin-vue2 references ==="
grep -r "vite-plugin-vue2" examples/vue/ --include="*.json" --include="*.js" --include="*.ts" 2>/dev/nullRepository: TanStack/query
Length of output: 2456
🏁 Script executed:
#!/bin/bash
# Get the full package.json for context
echo "=== Full package.json for 2.6-basic example ==="
cat examples/vue/2.6-basic/package.jsonRepository: TanStack/query
Length of output: 564
🌐 Web query:
CVE-2025-31486 Vite vulnerability fix version
💡 Result:
Fixed in Vite versions 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5. [1][2]
References:
[1] NVD - CVE-2025-31486.
[2] OSV / GitHub advisory (GHSA-xcj6-pq6g-qj4x).
🌐 Web query:
CVE-2025-32395 Vite vulnerability fix version
💡 Result:
CVE-2025-32395 is fixed in Vite versions 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 — upgrade to one of those patched releases. [1][2]
Sources:
[1] NVD / CVE entry for CVE-2025-32395.
[2] Vite / GitHub security advisory and fix.
🌐 Web query:
vite-plugin-vue2 Vite 7 compatibility support
💡 Result:
Short answer: don't use vite-plugin-vue2 for Vite 7. The original vite-plugin-vue2 is legacy/maintenance-mode (targets Vue ≤2.6) and won’t be the path forward for Vue 2.7 / newer Vite. Use the official @vitejs/plugin-vue2 (made for Vue 2.7 and maintained by the Vite team) for Vite (including Vite 7) compatibility. [1][2][3]
Sources:
- vite-plugin-vue2 (legacy / maintenance; targets Vue ≤2.6). [1]
- Vue 2.7 notes: Vite support is provided via @vitejs/plugin-vue2. [2]
- Vite plugins listing (official @vitejs/plugin-vue2). [3]
🌐 Web query:
Vite 7 Node.js version requirements
💡 Result:
Vite 7 requires Node.js 20.19+ or 22.12+ (Node 18 support was dropped after its EOL in April 2025). [1][2]
Sources:
- Vite 7 announcement (official). [1]
- Cloudflare changelog noting Vite 7 support and Node.js minimums. [2]
Critical: Unsupported plugin-version combination and incorrect CVE information.
The project uses vite-plugin-vue2@2.0.3 with vite@^7.3.1, which is an unsupported combination. The vite-plugin-vue2 package is in maintenance mode and targets Vue ≤2.6 only; it does not support Vite 7. For Vite 7 compatibility, use the official @vitejs/plugin-vue2 instead. This affects both the 2.6-basic and 2.7-basic examples.
Additional concerns:
- CVE-2025-31486 is fixed in Vite
4.5.12,5.4.17,6.0.14,6.1.4, and6.2.5(not the versions previously stated). - Vite 7 requires Node.js 20.19+ or 22.12+, as Node.js 18 reached EOL in April 2025.
- Version discrepancy exists: the PR objectives reference updating to 6.4.1, but the code shows 7.3.1 across both examples; clarify which version is intended.
Fix required:
- Either downgrade vite to 6.x and use an appropriate plugin for Vue 2.6, or upgrade to
@vitejs/plugin-vue2if targeting Vue 2.7+.
🤖 Prompt for AI Agents
In @examples/vue/2.6-basic/package.json at line 18, The package.json currently
pins "vite": "^7.3.1" while still using vite-plugin-vue2 (maintenance-only for
Vue ≤2.6) which is incompatible with Vite 7; fix by either downgrading vite to a
6.x release that includes the CVE-2025-31486 fixes (e.g., any
>=6.0.14/6.1.4/6.2.5 per the CVE note) and keep vite-plugin-vue2 for the
2.6-basic example, or upgrade the plugin to @vitejs/plugin-vue2 if you intend to
target Vite 7 and Vue 2.7+; also update documentation/PR text to resolve the
version discrepancy (6.4.1 vs 7.3.1) and note Node.js minimums for Vite 7 (Node
20.19+ or 22.12+), and ensure the CVE-2025-31486 version references are
corrected.
bc42c50 to
a693558
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @examples/vue/2.7-basic/package.json:
- Around line 15-19: Replace the deprecated devDependency "vite-plugin-vue2"
with the official "@vitejs/plugin-vue2" in package.json's devDependencies
(remove "vite-plugin-vue2": "2.0.3" and add "@vitejs/plugin-vue2" at a
compatible version), then run install; also update any imports/usages in your
Vite config (e.g., change import from "vite-plugin-vue2" to
"@vitejs/plugin-vue2" and ensure the plugin is passed to defineConfig/plugins in
vite.config.js) so the project uses the official Vue 2.7+ Vite plugin compatible
with Vite ^5.4.21.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
examples/vue/2.6-basic/package.jsonexamples/vue/2.7-basic/package.json
🚧 Files skipped from review as they are similar to previous changes (1)
- examples/vue/2.6-basic/package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Test
| "devDependencies": { | ||
| "typescript": "5.8.3", | ||
| "vite": "^4.5.14", | ||
| "vite": "^5.4.21", | ||
| "vite-plugin-vue2": "2.0.3" | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
CVE-2025-31486 CVE-2025-32395 CVE-2025-46565 Vite vulnerability fix versions
💡 Result:
-
CVE-2025-31486 — fixed in Vite 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5. [1]
-
CVE-2025-32395 — fixed in Vite 4.5.13, 5.4.18, 6.0.15, 6.1.5, and 6.2.6. [2]
-
CVE-2025-46565 — fixed in Vite 4.5.14, 5.4.19, 6.1.6, 6.2.7, and 6.3.4. [3]
Sources: [1] NVD/GitHub advisory for CVE-2025-31486. [2] Vite/GitHub advisory summaries for CVE-2025-32395. [3] CVE details/GitHub advisory for CVE-2025-46565.
🌐 Web query:
vite-plugin-vue2 compatibility Vite 5 6 7
💡 Result:
Short answer: don't use the old community "vite-plugin-vue2" for Vite 5/6/7 — use the official @vitejs/plugin-vue2 (for Vue 2.7+) which is the supported plugin for Vite's modern releases. [1][2][3][4]
Notes:
- vite-plugin-vue2 has been deprecated/put into maintenance and only supports older Vue 2.6-era setups. [1][4]
- @vitejs/plugin-vue2 is the official plugin for Vue 2.7+ and is the one referenced in Vite docs; JSX/TSX for Vue 2 is handled by a separate plugin. Use @vitejs/plugin-vue2 with Vite 5/6/7. [2][3]
Sources:
- vite-plugin-vue2 deprecation/maintenance notice. [1]
- @vitejs/plugin-vue2 GitHub / npm (official plugin for Vue 2.7+). [2][3]
- Vite plugins documentation listing @vitejs/plugin-vue2. [4]
🏁 Script executed:
# Check if there are other package.json files or lock files in the repo that might provide context
git ls-files | grep -E "(package\.json|pnpm-lock|yarn\.lock|package-lock)" | head -20Repository: TanStack/query
Length of output: 939
🌐 Web query:
CVE-2025-58751 CVE-2025-58752 Vite vulnerability fix
💡 Result:
Short answer — what happened and what to do:
-
Two Vite dev-server vulnerabilities (CVE-2025-58751 and CVE-2025-58752) allow the dev/preview server to serve HTML or public files outside the intended root (path traversal / public-file serving bypass) when the dev server is exposed to the network and the public dir / symlink conditions are met. [1][2]
-
Affected versions (examples): 7.1.0–7.1.4, 7.0.0–7.0.6, 6.0.0–6.3.5, and <=5.4.19 (see advisories for full ranges). [1][2]
-
Patched versions: 7.1.5, 7.0.7, 6.3.6, and 5.4.20. Upgrade to one of these or any later release. Example: npm install vite@7.1.5 (or update your package.json and run your package manager). [1][2]
-
Short mitigations until you can upgrade: do NOT expose the Vite dev server to untrusted networks (avoid --host / server.host), remove symlinks in the public directory, and avoid enabling the preview server to untrusted networks. [1][3]
Sources:
- GitHub Security Advisory (vite): GHSA-g4jq-h2w9-997c (patch/patched versions).
- NVD entries for CVE-2025-58751 and CVE-2025-58752 (details and fixed versions).
- Vendor/third‑party writeups summarizing impact and mitigations.
🌐 Web query:
CVE-2025-62522 Vite vulnerability
💡 Result:
Short summary — CVE-2025-62522 (published Oct 20, 2025): a path-handling bug in the Vite dev server on Windows that lets an attacker bypass server.fs.deny by requesting a URL that ends with a backslash, causing denied files (e.g., .env, *.pem) to be served if the dev server is exposed to the network. Affects multiple Vite release ranges (see below). [1][2][3]
Affected versions (per advisories): Vite 2.9.18 → <3.0.0, 3.2.9 → <4.0.0, 4.5.3 → <5.0.0, 5.2.6 → <5.4.21, 6.0.0 → <6.4.1, 7.0.0 → <7.0.8, 7.1.0 → <7.1.11. Published/confirmed Oct 20, 2025. [1][2]
Impact: medium severity (CVSS v4.0 = 6.0). Only exploitable when the Vite dev server is intentionally exposed to the network and running on Windows; it can disclose sensitive files normally blocked by server.fs.deny. [1][3]
Mitigation:
- Upgrade Vite to a patched release: 5.4.21, 6.4.1, 7.0.8, or 7.1.11 (or later). [1][2]
- As a workaround, do not expose the dev server to external networks (bind to localhost / block with firewall) and ensure sensitive files aren’t served by the project. [2][3]
References:
[1] GitHub / Vite advisory & fixes (commit/advisory referenced by vendor).
[2] NVD / CVE-2025-62522 summary.
[3] Positive Technologies / dbugs advisory (technical details and recommendations).
🏁 Script executed:
# Check for lockfiles in the vue example directory and parent
cd examples/vue/2.7-basic && ls -laRepository: TanStack/query
Length of output: 581
🏁 Script executed:
# Also check the current full package.json to see dependencies context
cat examples/vue/2.7-basic/package.jsonRepository: TanStack/query
Length of output: 505
🏁 Script executed:
# Check if there are comments or PR description in nearby files
git log --oneline -n 20 -- examples/vue/2.7-basic/package.json 2>/dev/null | head -5Repository: TanStack/query
Length of output: 113
Replace deprecated vite-plugin-vue2 with the official @vitejs/plugin-vue2.
The vite version bump to ^5.4.21 is correct and does address all five CVEs mentioned in the PR (CVE-2025-31486, CVE-2025-32395, CVE-2025-46565, CVE-2025-58751/58752, and CVE-2025-62522—which is specifically fixed in 5.4.21).
However, vite-plugin-vue2@2.0.3 is deprecated and not recommended for modern Vite versions. For Vue 2.7+, use the official @vitejs/plugin-vue2 plugin instead. Update the devDependency accordingly.
🤖 Prompt for AI Agents
In @examples/vue/2.7-basic/package.json around lines 15 - 19, Replace the
deprecated devDependency "vite-plugin-vue2" with the official
"@vitejs/plugin-vue2" in package.json's devDependencies (remove
"vite-plugin-vue2": "2.0.3" and add "@vitejs/plugin-vue2" at a compatible
version), then run install; also update any imports/usages in your Vite config
(e.g., change import from "vite-plugin-vue2" to "@vitejs/plugin-vue2" and ensure
the plugin is passed to defineConfig/plugins in vite.config.js) so the project
uses the official Vue 2.7+ Vite plugin compatible with Vite ^5.4.21.
This PR contains the following updates:
6.3.6→6.4.1^4.5.14→^5.4.21Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2025-31486
Summary
The contents of arbitrary files can be returned to the browser.
Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Details
.svgRequests ending with
.svgare loaded at this line.https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding
?.svgwith?.wasm?initor withsec-fetch-dest: scriptheader, the restriction was able to bypass.This bypass is only possible if the file is smaller than
build.assetsInlineLimit(default: 4kB) and when using Vite 6.0+.relative paths
The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g.
../../).PoC
npm create vite@latest cd vite-project/ npm install npm run devsend request to read
etc/passwdcurl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'curl 'http://127.0.0.1:5173/@​fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'CVE-2025-32395
Summary
The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun.
Impact
Only apps with the following conditions are affected.
Details
HTTP 1.1 spec (RFC 9112) does not allow
#inrequest-target. Although an attacker can send such a request. For those requests with an invalidrequest-line(it includesrequest-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2 (ref1, ref2, ref3).On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of
http.IncomingMessage.urlcontains#. Vite assumedreq.urlwon't contain#when checkingserver.fs.deny, allowing those kinds of requests to bypass the check.On Deno, those requests are not rejected internally and is passed to the user land as well. But for those requests, the value of
http.IncomingMessage.urldid not contain#.PoC
send request to read
/etc/passwdCVE-2025-46565
Summary
The contents of files in the project
rootthat are denied by a file matching pattern can be returned to the browser.Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project
rootand are denied by a file matching pattern can be bypassed..env,.env.*,*.{crt,pem},**/.env**/.git/**,.git/**,.git/**/*Details
server.fs.denycan contain patterns matching against files (by default it includes.env,.env.*,*.{crt,pem}as such patterns).These patterns were able to bypass for files under
rootby using a combination of slash and dot (/.).PoC
CVE-2025-58752
Summary
Any HTML files on the machine were served regardless of the
server.fssettings.Impact
Only apps that match the following conditions are affected:
appType: 'spa'(default) orappType: 'mpa'is usedThis vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served.
Details
The serveStaticMiddleware function is in charge of serving static files from the server. It returns the viteServeStaticMiddleware function which runs the needed tests and serves the page. The viteServeStaticMiddleware function checks if the extension of the requested file is ".html". If so, it doesn't serve the page. Instead, the server will go on to the next middlewares, in this case htmlFallbackMiddleware, and then to indexHtmlMiddleware. These middlewares don't perform any test against allow or deny rules, and they don't make sure that the accessed file is in the root directory of the server. They just find the file and send back its contents to the client.
PoC
Execute the following shell commands:
Then, in a different shell, run the following command:
curl -v --path-as-is 'http://localhost:5173/../../../../../../../../../../../tmp/secret.html'The contents of /tmp/secret.html will be returned.
This will also work for HTML files that are in the root directory of the project, but are in the deny list (or not in the allow list). Test that by stopping the running server (CTRL+C), and running the following commands in the server's shell:
Then, in a different shell, run the following command:
curl -v --path-as-is 'http://localhost:5173/secret_files/secret.txt'You will receive a 403 HTTP Response, because everything in the secret_files directory is denied.
Now in the same shell run the following command:
curl -v --path-as-is 'http://localhost:5173/secret_files/secret.html'You will receive the contents of secret_files/secret.html.
CVE-2025-58751
Summary
Files starting with the same name with the public directory were served bypassing the
server.fssettings.Impact
Only apps that match the following conditions are affected:
server.hostconfig option)Details
The servePublicMiddleware function is in charge of serving public files from the server. It returns the viteServePublicMiddleware function which runs the needed tests and serves the page. The viteServePublicMiddleware function checks if the publicFiles variable is defined, and then uses it to determine if the requested page is public. In the case that the publicFiles is undefined, the code will treat the requested page as a public page, and go on with the serving function. publicFiles may be undefined if there is a symbolic link anywhere inside the public directory. In that case, every requested page will be passed to the public serving function. The serving function is based on the sirv library. Vite patches the library to add the possibility to test loading access to pages, but when the public page middleware disables this functionality since public pages are meant to be available always, regardless of whether they are in the allow or deny list.
In the case of public pages, the serving function is provided with the path to the public directory as a root directory. The code of the sirv library uses the join function to get the full path to the requested file. For example, if the public directory is "/www/public", and the requested file is "myfile", the code will join them to the string "/www/public/myfile". The code will then pass this string to the normalize function. Afterwards, the code will use the string's startsWith function to determine whether the created path is within the given directory or not. Only if it is, it will be served.
Since sirv trims the trailing slash of the public directory, the string's startsWith function may return true even if the created path is not within the public directory. For example, if the server's root is at "/www", and the public directory is at "/www/p", if the created path will be "/www/private.txt", the startsWith function will still return true, because the string "/www/private.txt" starts with "/www/p". To achieve this, the attacker will use ".." to ask for the file "../private.txt". The code will then join it to the "/www/p" string, and will receive "/www/p/../private.txt". Then, the normalize function will return "/www/private.txt", which will then be passed to the startsWith function, which will return true, and the processing of the page will continue without checking the deny list (since this is the public directory middleware which doesn't check that).
PoC
Execute the following shell commands:
Then, in a different shell, run the following command:
curl -v --path-as-is 'http://localhost:5173/private.txt'You will receive a 403 HTTP Response, because private.txt is denied.
Now in the same shell run the following command:
curl -v --path-as-is 'http://localhost:5173/../private.txt'You will receive the contents of private.txt.
Related links
CVE-2025-62522
Summary
Files denied by
server.fs.denywere sent if the URL ended with\when the dev server is running on Windows.Impact
Only apps that match the following conditions are affected:
server.hostconfig option)Details
server.fs.denycan contain patterns matching against files (by default it includes.env,.env.*,*.{crt,pem}as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is thatfs.readFile('/foo.png/')loads/foo.png.PoC
Release Notes
vitejs/vite (vite)
v6.4.1Compare Source
Please refer to CHANGELOG.md for details.
v6.4.0Compare Source
Please refer to CHANGELOG.md for details.
v6.3.7Compare Source
Please refer to CHANGELOG.md for details.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.