6

CVE-2025-32395: vitejs vite

CVSS: 6.0v4.0MediumDeferred
AliasesGHSA-356w-63v5-8wf4CGA-8779-gwpm-55qgCGA-c3v2-hj9g-mvrm
Published 10-04-2025Last modified 10-04-2025
Open JSON

Vulnerability summary

CVE-2025-32395 is a medium (CVSS 6.0) vulnerability in vitejs vite. EPSS estimates a 1.77% chance of exploitation in the next 30 days, higher than 77.8% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.0/10
010
Medium · v4.0 (CVE.org)
EPSS score
1.77%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 4
CGA-G458-942V-6G6RCGA-MCXC-5X95-9CC6CGA-PF2H-Q7X3-3P32CGA-QRV6-J45X-4VWF

Timeline

  1. 10-04-2025
    PublishedVulnerability first disclosed.
  2. 10-04-2025
    Last modifiedVulnerability information updated.

Description

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) and running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun) are affected. This vulnerability is fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

1.77%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

+0.03 pp

From 1.75% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.77%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard2 products
  • langfuse-2-worker< 2.95.12-r26
  • langfuse-fips-2-worker< 2.95.12-r28
Npm1 product
  • vite≥ 6.2.0, < 6.2.6 | ≥ 6.1.0, < 6.1.5 | ≥ 6.0.0, < 6.0.15 | ≥ 5.0.0, < 5.4.18 | < 4.5.13
Vitejs1 product
  • vite≥ 6.2.0, < 6.2.6 | ≥ 6.1.0, < 6.1.5 | ≥ 6.0.0, < 6.0.15 | ≥ 5.0.0, < 5.4.18 | < 4.5.13

3 vendors · 4 products

References

5 links