CVE-2026-53571 is a path traversal vulnerability in vitejs vite's development server on Windows platforms. The server uses server.fs.deny to block direct access to sensitive files (e.g., .env, .env.*, *.{crt,pem}). However, the deny logic fails to properly normalize NTFS alternate data stream (ADS) paths before applying access checks. As a result, requests like /.env::$DATA?raw bypass restrictions because Windows resolves these to the original file's default data stream. Similarly, Windows 8.3 short name compatibility allows accessing files via alternate short names, which vite did not block. This leads to unauthorized disclosure of sensitive file contents. The vulnerability is addressed in vite versions 8.0.16, 7.3.5, and 6.4.3.

An attacker can bypass file access restrictions on Windows systems running vulnerable vite versions to read sensitive files that should be denied by server.fs.deny. This includes environment variable files (.env) and certificate files (*.crt, *.pem). The exposure of such files can lead to leakage of secrets, credentials, or private keys, potentially compromising application security and confidentiality.

This vulnerability is fixed in vite versions 8.0.16, 7.3.5, and 6.4.3. Users should upgrade to one of these versions or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the fixed versions specified.