CVE-2025-46565: Vite's server.fs.deny bypassed with /. for files under project root

April 30, 2025 (updated October 31, 2025)

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

References

github.com/advisories/GHSA-859w-5945-r5v3
github.com/vitejs/vite
github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb
github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3
nvd.nist.gov/vuln/detail/CVE-2025-46565

Code Behaviors & Features

Detect and mitigate CVE-2025-46565 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →