CVE-2025-31486

Vite, a widely used JavaScript frontend tooling framework, contains a bypass of the server.fs.deny restriction that lets the dev server return the contents of arbitrary files to the browser. An attacker triggers it by requesting a target path with a ?.svg suffix combined with ?.wasm?init or a sec-fetch-dest: script header, which succeeds only when the file is smaller than build.assetsInlineLimit (default 4kB) and when running Vite 6.0+. This yields disclosure of small sensitive files (e.g., config or environment files under 4kB) from the machine running the dev server. Only applications that explicitly expose the Vite dev server to the network via --host or the server.host config option are affected; fixed versions are 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5. No public proof-of-concept or CISA KEV listing exists yet, but the EPSS model assigns a 40.2% probability of exploitation within 30 days (99th percentile), so defenders should prioritize patching.

What to do: Upgrade Vite to 4.5.12, 5.4.17, 6.0.14, 6.1.4, or 6.2.5, matching your current major version. As an interim mitigation, avoid exposing the dev server via --host or server.host, or restrict network access to it with firewall rules. Inventory your environment for internet-exposed Vite dev servers (default port 5173) and review server.fs.deny configurations.