Information disclosure in Vitejs Vite
CVE-2025-32395
Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) and running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun) are affected. This vulnerability is fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13.
Vulnerability class: Information Disclosure
Published · last modified .
EPSS exploit prediction
EPSS: 0.017 (76.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: +0.000
Affected products
- Vitejs Vite — versions >= 6.2.0, < 6.2.6, >= 6.1.0, < 6.1.5, >= 6.0.0, < 6.0.15
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-32395?
- CVE-2025-32395 is a vulnerability in Vitejs Vite, classified under Information Disclosure. Published 2025-04-10.
- Is CVE-2025-32395 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.