--- id: "CVE-2026-53571" kind: "vulnerability" aliases: ["CVE-2026-53571", "GHSA-fx2h-pf6j-xcff"] title: "vite: `server.fs.deny` bypass on Windows alternate paths" severity: "high" cvss: 8.2 epss: 0.00577 exploited: false status: "open" category: "package" products: [{"name": "vite", "fixed": ["8.0.16"], "affected": ">= 8.0.0, <= 8.0.15", "ecosystem": "npm"}, {"name": "vite", "fixed": ["7.3.5"], "affected": ">= 7.0.0, <= 7.3.4", "ecosystem": "npm"}, {"name": "vite", "fixed": ["6.4.3"], "affected": "<= 6.4.2", "ecosystem": "npm"}, {"name": "vite-plus", "fixed": ["0.1.24"], "affected": "<= 0.1.23", "ecosystem": "npm"}, {"name": "vitejs vite", "fixed": ["6.4.3"], "affected": "< 6.4.3", "ecosystem": "vendor"}, {"name": "vitejs vite", "fixed": ["7.3.5"], "affected": ">= 7.0.0, < 7.3.5", "ecosystem": "vendor"}, {"name": "vitejs vite", "fixed": ["8.0.16"], "affected": ">= 8.0.0, < 8.0.16", "ecosystem": "vendor"}, {"name": "voidzero vite\\+", "fixed": ["0.1.24"], "affected": "< 0.1.24", "ecosystem": "vendor"}] ecosystems: ["npm", "vendor"] tags: ["cwe-200", "cwe-22", "dev-server", "npm", "package", "vite", "vite-plus", "windows"] not_affected_if: ["localhost-only-binding", "no-network-host-flag", "non-windows", "production-build"] published_at: "2026-06-15T17:17:45+00:00" first_seen_at: "2026-10-27T15:03:12+00:00" updated_at: "2026-10-27T15:32:59+00:00" sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff", "first_seen_at": "2026-10-27T15:03:12+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53571", "first_seen_at": "2026-10-27T15:32:59+00:00"}] --- # vite: `server.fs.deny` bypass on Windows alternate paths On Windows, Vite's dev server fails to apply server.fs.deny to NTFS alternate data stream paths and 8.3 short names, so a request such as /.env::$DATA?raw returns the contents of a sensitive file. An attacker who can reach the dev server can read .env secrets and TLS private keys. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - npm:vite affected >= 8.0.0, <= 8.0.15 fixed 8.0.16 - npm:vite affected >= 7.0.0, <= 7.3.4 fixed 7.3.5 - npm:vite affected <= 6.4.2 fixed 6.4.3 - npm:vite-plus affected <= 0.1.23 fixed 0.1.24 - vendor:vitejs vite affected < 6.4.3 fixed 6.4.3 - vendor:vitejs vite affected >= 7.0.0, < 7.3.5 fixed 7.3.5 - vendor:vitejs vite affected >= 8.0.0, < 8.0.16 fixed 8.0.16 - vendor:voidzero vite\+ affected < 0.1.24 fixed 0.1.24 ## How to check - Run `npm ls vite` or `npm ls vite-plus` to find the installed version. - Check whether the dev server is started with `--host` or `server.host` set, which exposes it to the network. - Confirm the project runs on Windows with files in an NTFS volume, where the flaw applies. ## Fix - Upgrade `vite` to `8.0.16` on the 8.x line, `7.3.5` on the 7.x line, or `6.4.3` on the 6.x line. - Upgrade `vite-plus` to `0.1.24`. - Stop exposing the dev server to the network until upgraded, and rotate any secrets in `.env` or certificates if the dev server was reachable. ## Timeline - 2026-10-27T15:03:12+00:00 ghsa https://github.com/advisories/GHSA-fx2h-pf6j-xcff - 2026-10-27T15:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-53571 ## From the sources ### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows. ### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow) - either of: - the sensitive file exists in an NTFS volume - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes) ### Details Vite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. ### PoC ```bash $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev ``` Access via browser at `http://localhost:5173/.env::$DATA?raw` deecc1315123883cfd0f9c26a002845a Example expected result: - `/.env::$DATA?raw` returns the contents of `.env` - `/tls.pem::$DATA?raw` returns the contents of `tls.pem` --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_