Vite has an `server.fs.deny` bypass with an invalid `request-target` (CVE-2025-32395)
Vite versions from 2.5.1 up to but not including 6.2.6 have a vulnerability where the dev server's file system access restrictions can be bypassed using an invalid HTTP request-target containing a '#' character. This allows an attacker to retrieve arbitrary files if the dev server is explicitly exposed to the network and running on Node or Bun runtimes. The issue arises because Vite assumes the request URL will not contain '#', but Node and Bun do not reject such requests internally, enabling the bypass. Deno runtime is not affected due to different URL handling.
AI Analysis
Technical Summary
CVE-2025-32395 affects Vite dev servers running on Node or Bun when explicitly exposed to the network. The vulnerability exploits the fact that HTTP/1.1 and HTTP/2 specifications disallow '#' in the request-target, and such requests should be rejected with 400 or 301 responses. However, Node and Bun do not reject these requests internally and pass them to userland with the '#' included in the URL. Vite's server.fs.deny check assumes no '#' in the URL, allowing crafted requests with '#' to bypass file system access restrictions and return arbitrary file contents. This does not affect Deno runtime because it strips '#' from the URL before processing.
Potential Impact
An attacker can retrieve arbitrary files from the server's file system if the Vite dev server is exposed to the network and running on Node or Bun. This could lead to sensitive information disclosure. The vulnerability does not affect servers running on Deno or those not exposed to the network. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Vite to version 6.2.6 or later where this issue is fixed. If upgrading immediately is not possible, avoid exposing the Vite dev server to the network (do not use --host or server.host configuration to bind to external interfaces).
Vite has an `server.fs.deny` bypass with an invalid `request-target` (CVE-2025-32395)
Description
Vite versions from 2.5.1 up to but not including 6.2.6 have a vulnerability where the dev server's file system access restrictions can be bypassed using an invalid HTTP request-target containing a '#' character. This allows an attacker to retrieve arbitrary files if the dev server is explicitly exposed to the network and running on Node or Bun runtimes. The issue arises because Vite assumes the request URL will not contain '#', but Node and Bun do not reject such requests internally, enabling the bypass. Deno runtime is not affected due to different URL handling.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-32395 affects Vite dev servers running on Node or Bun when explicitly exposed to the network. The vulnerability exploits the fact that HTTP/1.1 and HTTP/2 specifications disallow '#' in the request-target, and such requests should be rejected with 400 or 301 responses. However, Node and Bun do not reject these requests internally and pass them to userland with the '#' included in the URL. Vite's server.fs.deny check assumes no '#' in the URL, allowing crafted requests with '#' to bypass file system access restrictions and return arbitrary file contents. This does not affect Deno runtime because it strips '#' from the URL before processing.
Potential Impact
An attacker can retrieve arbitrary files from the server's file system if the Vite dev server is exposed to the network and running on Node or Bun. This could lead to sensitive information disclosure. The vulnerability does not affect servers running on Deno or those not exposed to the network. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Vite to version 6.2.6 or later where this issue is fixed. If upgrading immediately is not possible, avoid exposing the Vite dev server to the network (do not use --host or server.host configuration to bind to external interfaces).
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-vite-CVE-2025-32395
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6abb419af7a7c54106cc3871
Added to database: 09/29/2026, 04:42:02 UTC
Last enriched: 09/29/2026, 04:54:16 UTC
Last updated: 09/29/2026, 18:11:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.