CVE-2026-53571 describes a path traversal vulnerability in vitejs vite's development server on Windows platforms. The server attempts to restrict access to sensitive files via server.fs.deny, blocking direct access to files like .env and certificate files. However, on Windows, the deny logic fails to normalize NTFS Alternate Data Stream (ADS) path forms and 8.3 short name aliases before applying access checks. This flaw permits attackers to bypass restrictions by requesting files using ADS syntax (e.g., /.env::$DATA?raw) or 8.3 short names, resulting in unauthorized file content disclosure. The vulnerability affects vite versions >=6.4.0 <6.4.3, >=7.0.0 <7.3.5, and >=8.0.0 <8.0.16 and is resolved in versions 6.4.3, 7.3.5, and 8.0.16.

An attacker can bypass file access restrictions on the vite development server running on Windows by exploiting improper normalization of NTFS ADS paths and 8.3 short names. This leads to unauthorized disclosure of sensitive files such as environment configuration files (.env) and certificate files (.crt, .pem). The vulnerability has a high severity with a CVSS 4.0 score of 8.2, indicating a significant risk of information exposure without requiring privileges or user interaction.

This vulnerability is fixed in vite versions 8.0.16, 7.3.5, and 6.4.3. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor's versioning and CVE description.