CVE-2025-32395: Vite has an `server.fs.deny` bypass with an invalid `request-target`

April 11, 2025 (updated October 31, 2025)

The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun.

References

github.com/advisories/GHSA-356w-63v5-8wf4
github.com/vitejs/vite
github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70
github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4
nvd.nist.gov/vuln/detail/CVE-2025-32395

Code Behaviors & Features

Detect and mitigate CVE-2025-32395 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →