CVE-2025-62522: vite allows server.fs.deny bypass via backslash on Windows

October 20, 2025 (updated November 10, 2025)

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

References

github.com/advisories/GHSA-93m4-6634-74q7
github.com/vitejs/vite
github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed
github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7
nvd.nist.gov/vuln/detail/CVE-2025-62522

Code Behaviors & Features

Detect and mitigate CVE-2025-62522 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →