Frontend Tooling Framework Vulnerability Affecting Vite by Vite.js
CVE-2026-53571

8.2HIGH

Key Information:

Vendor

Vitejs

Status
Vite
Vendor
CVE Published:
22 June 2026

What is CVE-2026-53571?

The vulnerability in Vite, a widely-used frontend tooling framework for JavaScript, poses a significant security risk on Windows systems. Prior to specific versions (8.0.16, 7.3.5, and 6.4.3), the server.fs.deny configuration meant to prevent access to sensitive files can be bypassed. Due to improper normalization of NTFS Alternate Data Streams (ADS), unauthorized access to files such as .env and security certificates can occur. The flaw arises when certain requests, treated incorrectly as allowed paths, expose sensitive information in the file system, especially when utilizing legacy file name compatibility on Windows. Affected users are urged to update to the latest versions to safeguard against this vulnerability.

Affected Version(s)

vite >= 8.0.0, < 8.0.16 < 8.0.0, 8.0.16

vite >= 7.0.0, < 7.3.5 < 7.0.0, 7.3.5

vite < 6.4.3 < 6.4.3

References

https://github.com/vitejs/vite/security/advisories/GHSA-f...
x_refsource_CONFIRM

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.