Information disclosure in Cloudflare Workers-Sdk
CVE-2025-59427
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
Vulnerability class: Information Disclosure
EPSS: 0.004 (28.4th percentile) — read the EPSS interpretation.
Affected products
- Cloudflare Workers-sdk — versions < 1.6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-59427?
- CVE-2025-59427 is a vulnerability in Cloudflare Workers-Sdk, classified under Information Disclosure. Published 2025-09-19.
- Is CVE-2025-59427 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.