CVE-2026-53571: Vite Server FS Deny Bypass Vulnerability on Windows
Summary
CVE-2026-53571: vite: server.fs.deny bypass on Windows alternate paths. Affects vite across 3 version ranges.
< 6.4.3
>= 7.0.0, < 7.3.5
>= 8.0.0, < 8.0.16
Fixed in 6.4.3, 7.3.5 or 8.0.16, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vite is a modern build tool that provides a fast and efficient development environment for web applications. It features hot module replacement, optimized builds, and a rich plugin ecosystem. However, Vite's development server has a vulnerability that allows sensitive files to be accessed under certain conditions, particularly on Windows systems.
Vulnerability Detail
The vulnerability arises from Vite's dev server failing to properly normalize NTFS Alternate Data Streams (ADS) paths before applying access checks for sensitive files specified in the server.fs.deny configuration. This oversight allows attackers to access sensitive files, such as .env or TLS certificates, via crafted requests that exploit Windows' handling of ADS. The impact is significant for applications that expose the Vite dev server to the network and have sensitive files in allowed directories, especially on NTFS volumes or when 8.3 short name generation is enabled.
How To Fix
Latest published version: 8.3.5 as of 22 Oct 2026
npm install vite@8.3.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.4.36.4.3npm install vite@6.4.3 -
>= 7.0.0, < 7.3.57.3.5npm install vite@7.3.5 -
>= 8.0.0, < 8.0.168.0.16npm install vite@8.0.16
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid exposing the Vite dev server to the network by not using the '--host' option or by setting the server.host configuration to 'localhost'. Additionally, ensure that sensitive files are not placed in directories allowed by server.fs.allow.
Conclusion
CVE-2026-53571 is a critical vulnerability in the Vite development server that can lead to unauthorized access to sensitive files on Windows systems. Users are strongly advised to update to the latest patched versions of Vite to mitigate this risk. For immediate checks, Vulert provides a convenient way to monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vite →
FAQ
CVE-2026-53571 is a vulnerability in the Vite development server that allows unauthorized access to sensitive files on Windows systems.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
Files such as .env, .env.*, and TLS certificates (e.g., *.crt, *.pem) are at risk of being accessed due to this vulnerability.
If you cannot update Vite immediately, consider restricting access to the Vite dev server and ensuring sensitive files are not in allowed directories.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vite.
