CVE-2026-53571

The contents of files that are specified by server.fs.deny can be returned to the browser on Windows.

Details

Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.
Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream.

Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

Access via browser at http://localhost:5173/.env::$DATA?raw

Example expected result:

• /.env::$DATA?raw returns the contents of .env
• /tls.pem::$DATA?raw returns the contents of tls.pem

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• the sensitive file exists in the allowed directories specified by server.fs.allow
• either of:
  • the sensitive file exists in an NTFS volume
  • the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

1. What is CVE-2026-53571? CVE-2026-53571 is a high-severity path traversal vulnerability in vite (npm), affecting versions >= 8.0.0, <= 8.0.15. It is fixed in 8.0.16, 7.3.5, 6.4.3, 0.1.24. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which packages are affected by CVE-2026-53571?
   • vite (npm) (versions >= 8.0.0, <= 8.0.15)
   • vite-plus (npm) (versions <= 0.1.23)
3. Is there a fix for CVE-2026-53571? Yes. CVE-2026-53571 is fixed in 8.0.16, 7.3.5, 6.4.3, 0.1.24. Upgrade to this version or later.
4. Is CVE-2026-53571 exploitable, and should I be worried? Whether CVE-2026-53571 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-53571 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-53571?
   • Upgrade vite to 8.0.16 or later
   • Upgrade vite to 7.3.5 or later
   • Upgrade vite to 6.4.3 or later
   • Upgrade vite-plus to 0.1.24 or later