{"action":"Upgrade vite to 4.5.13 or later.","affected":[{"fixed":"6.2.6","introduced":"6.2.0"},{"fixed":"6.1.5","introduced":"6.1.0"},{"fixed":"6.0.15","introduced":"6.0.0"},{"fixed":"5.4.18","introduced":"5.0.0"},{"fixed":"4.5.13","introduced":"0"}],"component":"vite","cve_ids":["CVE-2025-32395"],"ecosystem":"npm","epss":0.01775,"exploited":false,"fixed_versions":["6.2.6","6.1.5","6.0.15","5.4.18","4.5.13"],"ghsa_id":"GHSA-356w-63v5-8wf4","id":"tcs_01M5KEW09RB2ASX1WKY5CXX9PN","modified_at":"2026-09-10T03:50:56.951750105Z","published_at":"2025-04-11T14:06:03Z","references":["https://osv.dev/vulnerability/GHSA-356w-63v5-8wf4","https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4","https://nvd.nist.gov/vuln/detail/CVE-2025-32395","https://github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70","https://github.com/vitejs/vite"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GHSA-356w-63v5-8wf4","url":"https://osv.dev/vulnerability/GHSA-356w-63v5-8wf4"},{"source":"nvd","source_id":"CVE-2025-32395","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32395"}],"summary":"Vite has an `server.fs.deny` bypass with an invalid `request-target`"}