{"id":"CVE-2026-53571","kind":"vulnerability","aliases":["CVE-2026-53571","GHSA-fx2h-pf6j-xcff"],"related":[],"title":"vite: `server.fs.deny` bypass on Windows alternate paths","description":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- either of:\n  - the sensitive file exists in an NTFS volume\n  - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)\n\n### Details\n\nVite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.\nBecause of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.\n\nSimilar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\nAccess via browser at `http://localhost:5173/.env::$DATA?raw`\n<img width=\"388\" height=\"129\" alt=\"deecc1315123883cfd0f9c26a002845a\" src=\"https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170\" />\n\nExample expected result:\n- `/.env::$DATA?raw` returns the contents of `.env`\n- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`","summary":"On Windows, Vite's dev server fails to apply server.fs.deny to NTFS alternate data stream paths and 8.3 short names, so a request such as /.env::$DATA?raw returns the contents of a sensitive file. An attacker who can reach the dev server can read .env secrets and TLS private keys.","severity":"high","cvss":8.2,"epss":0.00577,"exploited":false,"exploited_at":null,"products":[{"name":"vite","fixed":["8.0.16"],"affected":">= 8.0.0, <= 8.0.15","ecosystem":"npm"},{"name":"vite","fixed":["7.3.5"],"affected":">= 7.0.0, <= 7.3.4","ecosystem":"npm"},{"name":"vite","fixed":["6.4.3"],"affected":"<= 6.4.2","ecosystem":"npm"},{"name":"vite-plus","fixed":["0.1.24"],"affected":"<= 0.1.23","ecosystem":"npm"},{"name":"vitejs vite","fixed":["6.4.3"],"affected":"< 6.4.3","ecosystem":"vendor"},{"name":"vitejs vite","fixed":["7.3.5"],"affected":">= 7.0.0, < 7.3.5","ecosystem":"vendor"},{"name":"vitejs vite","fixed":["8.0.16"],"affected":">= 8.0.0, < 8.0.16","ecosystem":"vendor"},{"name":"voidzero vite\\+","fixed":["0.1.24"],"affected":"< 0.1.24","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-200","cwe-22","dev-server","npm","package","vite","vite-plus","windows"],"not_affected_if":["localhost-only-binding","no-network-host-flag","non-windows","production-build"],"how_to_check":"- Run `npm ls vite` or `npm ls vite-plus` to find the installed version.\n- Check whether the dev server is started with `--host` or `server.host` set, which exposes it to the network.\n- Confirm the project runs on Windows with files in an NTFS volume, where the flaw applies.","fix":"- Upgrade `vite` to `8.0.16` on the 8.x line, `7.3.5` on the 7.x line, or `6.4.3` on the 6.x line.\n- Upgrade `vite-plus` to `0.1.24`.\n- Stop exposing the dev server to the network until upgraded, and rotate any secrets in `.env` or certificates if the dev server was reachable.","status":"open","published_at":"2026-06-15T17:17:45+00:00","first_seen_at":"2026-10-27T15:03:12+00:00","triaged_at":"2026-10-27T15:04:13+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T15:04:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `vite` to `8.0.16` on the 8.x line, `7.3.5` on the 7.x line, or `6.4.3` on the 6.x line.\n- Upgrade `vite-plus` to `0.1.24`.\n- Stop exposing the dev server to the network until upgraded, and rotate any secrets in `.env` or certificates if the dev server was reachable.","reach":"network","title":"Vite: dev server leaks denied files on Windows via alternate paths","impact":"medium","summary":"On Windows, Vite's dev server fails to apply server.fs.deny to NTFS alternate data stream paths and 8.3 short names, so a request such as /.env::$DATA?raw returns the contents of a sensitive file. An attacker who can reach the dev server can read .env secrets and TLS private keys.","category":"package","nicknames":[],"who_cares":["vite","vite-plus","windows","npm","dev-server"],"confidence":0.8,"needs_auth":"no","worst_case":"Secrets and private keys in project files readable by any network client","analyst_note":"","how_to_check":"- Run `npm ls vite` or `npm ls vite-plus` to find the installed version.\n- Check whether the dev server is started with `--host` or `server.host` set, which exposes it to the network.\n- Confirm the project runs on Windows with files in an NTFS volume, where the flaw applies.","needs_analyst":false,"not_affected_if":["localhost-only-binding","non-windows","no-network-host-flag","production-build"],"who_is_affected":"Only Windows developers who run the Vite dev server with network exposure (`--host` or `server.host`) and have sensitive files such as `.env` or `*.pem` inside allowed directories. Production builds and dev servers bound to localhost are not affected by the sources' conditions, and teams on macOS or Linux are outside the reported path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4047,"output_tokens":683,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-200':34B '-2026':9A,17A '-22':36B '-53571':10A,18A '/.env':72B,248C,321C '/config/server-options#server-fs-allow)':160C '/config/server-options#server-fs-deny)':110C '/config/server-options.html#server-host))':146C '/tls.pem':329C '5173/.env':315C '8.3':64B,187C,282C 'access':208C,238C,273C,291C,310C 'ad':234C 'affect':128C 'allow':153C,254C,272C 'altern':6A,59B 'app':121C 'appli':55B,241C 'attack':83B 'bash':296C 'browser':116C,312C 'bypass':3A 'cd':301C 'check':239C 'compat':285C 'condit':126C 'config':142C 'content':77B,100C,326C,334C 'correct':231C 'creat':298C 'crt':221C 'cve':8A,16A 'cwe':33B,35B 'data':60B,73B,249C,266C,316C,322C,330C 'default':197C,265C 'deni':206C,227C 'detail':201C 'dev':38B,51B,88B,133C,172C,204C,309C 'dev-serv':37B 'differ':278C 'direct':207C 'directori':154C 'either':161C 'enabl':192C,195C 'entri':215C 'env':92B,218C,219C,328C 'exampl':318C 'exist':150C,166C,182C 'expect':319C 'explicit':129C 'expos':130C 'fail':53B 'featur':286C 'file':81B,102C,149C,165C,181C,211C,263C,275C,292C 'follow':125C 'form':236C 'fx2h':13A 'generat':190C 'ghsa':12A 'ghsa-fx2h-pf6j-xcff':11A 'host':139C 'howev':223C 'impact':119C 'includ':214C 'instal':306C 'key':97B 'latest':300C 'localhost':314C 'logic':228C 'match':123C 'name':66B,189C,279C,284C 'network':137C 'normal':232C 'npm':40B,297C,305C,307C 'ntfs':58B,169C,233C 'option':143C 'origin':262C 'packag':41B 'path':7A,62B,235C,255C 'pem':222C 'pf6j':14A 'plus':24A,45B 'poc':295C 'privat':96B 'project':304C 'raw':74B,250C,317C,323C,331C 'reach':86B 'read':91B 'reject':290C 'request':69B,245C 'resolv':258C 'result':320C 'return':75B,113C,324C,332C 'run':175C,308C 'secret':93B 'sensit':80B,148C,164C,180C,210C 'server':39B,52B,89B,134C,173C,205C 'server.fs.allow':157C 'server.fs.deny':2A,56B,107C,213C 'server.host':141C 'short':65B,188C,283C 'similar':268C 'specifi':105C,155C 'stream':61B,267C 'summari':98C 'system':199C 'tls':95B 'tls.pem':336C 'treat':252C 'use':138C,276C 'via':293C,311C 'vite':1A,19A,20A,21A,23A,26A,28A,30A,32A,42B,44B,49B,132C,202C,287C,299C,303C 'vite-plus':22A,43B 'vite-project':302C 'vite.dev':109C,159C 'vite.dev/config/server-options#server-fs-allow)':158C 'vite.dev/config/server-options#server-fs-deny)':108C 'vitejs':25A,27A,29A 'vitejs.dev':145C 'vitejs.dev/config/server-options.html#server-host))':144C 'voidzero':31A 'volum':170C,185C,200C 'window':5A,46B,48B,118C,177C,225C,257C,271C 'xcff':15A","nicknames":[],"mitigations":[],"who_affected":"Only Windows developers who run the Vite dev server with network exposure (`--host` or `server.host`) and have sensitive files such as `.env` or `*.pem` inside allowed directories. Production builds and dev servers bound to localhost are not affected by the sources' conditions, and teams on macOS or Linux are outside the reported path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-15T17:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-fx2h-pf6j-xcff","url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","severity":"medium","published_at":"2026-06-15T17:17:45+00:00","modified_at":"2026-10-27T14:58:31+00:00","first_seen_at":"2026-10-27T15:03:12+00:00","fetched_at":"2026-10-27T15:03:12+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-53571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53571","severity":null,"published_at":"2026-06-22T18:16:44+00:00","modified_at":"2026-10-25T23:10:00+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}