CVE-2025-31486

npm/vite CVE-2025-31486: medium 5.3, EPSS 40.46%

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Action: Upgrade vite to 4.5.12 or later.

npm i vite@6.2.5

npm i vite@6.1.4

npm i vite@6.0.14

npm i vite@5.4.17

npm i vite@4.5.12

Affected

Fixed versions

Sources

• osv: GHSA-xcj6-pq6g-qj4x
• https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
• https://nvd.nist.gov/vuln/detail/CVE-2025-31486
• https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
• https://github.com/vitejs/vite
• https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290

CVE-2025-31486 · published 2025-04-04T14:20:05Z · modified 2026-09-10T03:49:36.567949213Z · JSON