CVE-2025-32395: Vite has an `server.fs.deny` bypass with an invalid `request-target`
N/A
Basic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vite | npm | >= 6.2.0, < 6.2.6 | 6.2.6 |
| vite | npm | >= 6.1.0, < 6.1.5 | 6.1.5 |
| vite | npm | >= 6.0.0, < 6.0.15 | 6.0.15 |
| vite | npm | >= 5.0.0, < 5.4.18 | 5.4.18 |
| vite | npm | < 4.5.13 | 4.5.13 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability lies in a bypass of the server.fs.deny mechanism in Vite's development server, enabling unauthorized file access. The root cause is the improper handling of URLs containing a '#' character in the request target, which is not compliant with the HTTP specification but is passed through by Node.js and Bun runtimes. Vite's file serving logic did not account for the presence of the '#' fragment in the URL, leading to a path traversal vulnerability.
The provided patch addresses this by introducing a new middleware, rejectInvalidRequestMiddleware. This middleware, defined in the new file packages/vite/src/node/server/middlewares/rejectInvalidRequest.ts, inspects incoming requests. If a '#' is found in req.url, it immediately sends a 400 Bad Request response, effectively stopping any further processing.
The critical change is within the _createServer function in packages/vite/src/node/server/index.ts. This function is responsible for assembling the server's middleware stack. The patch inserts the new rejectInvalidRequestMiddleware into this stack. By identifying _createServer as the vulnerable function, we are highlighting the location where the flawed request handling pipeline was configured, which is the most precise point of intervention shown in the patch.