CVE-2025-32395
1 advisory.
npm/vite CVE-2025-32395: medium, EPSS 1.77%
Vite has an `server.fs.deny` bypass with an invalid `request-target`
Action: Upgrade vite to 4.5.13 or later.
npm i vite@6.2.6npm i vite@6.1.5npm i vite@6.0.15npm i vite@5.4.18npm i vite@4.5.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.2.0 | 6.2.6 | - |
| 6.1.0 | 6.1.5 | - |
| 6.0.0 | 6.0.15 | - |
| 5.0.0 | 5.4.18 | - |
| 0 | 4.5.13 | - |
Fixed versions
| 6.2.6 | 6.1.5 | 6.0.15 | 5.4.18 | 4.5.13 |
Sources
- osv: GHSA-356w-63v5-8wf4
- https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4
- https://nvd.nist.gov/vuln/detail/CVE-2025-32395
- https://github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70
- https://github.com/vitejs/vite
CVE-2025-32395 · published · modified · JSON