CVE-2026-53571 Details
Description
Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.
A vulnerability exists in Vite, a frontend tooling framework for JavaScript, prior to versions 8.0.16, 7.3.5, and 6.4.3. On Windows, the dev server's file access denial logic does not properly normalize NTFS Alternate Data Stream (ADS) paths before applying access checks. This oversight allows sensitive files, such as those specified in server.fs.deny, to be accessed through alternate paths, potentially exposing their contents to the browser. The issue is exacerbated by Windows' 8.3 short name compatibility feature, which can also be used to bypass file access restrictions.
Users can update to Vite versions 8.0.16, 7.3.5, or 6.4.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff | CISA-ADP | ExploitVendor Advisory |
| https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vitejs vite | < 6.4.3 >= 7.0.0, < 7.3.5 >= 8.0.0, < 8.0.16 |
CPE
Remediation
| |
| voidzero vite+ | < 0.1.24 |
CPE
Remediation
| |
| microsoft windows | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |