Vite development-server file exposure CVE-2025-31125 exploited despite available fixes
Attackers are using CVE-2025-31125 to read restricted files from network-exposed Vite development servers. Fixes have existed since March 2025. Developers should update Vite, remove public access and replace potentially exposed credentials.
Most families have nothing to update themselves: this affects website development systems. If you or your business use Vite, ask the developer to install the latest supported release, remove public access to development servers and replace credentials that an exposed server could have disclosed.
What’s happening
Vite, a tool developers use to build websites, can disclose restricted files through its development server because of CVE-2025-31125. Only servers explicitly exposed to a network are affected. Vite published fixes in March 2025 across its affected release branches, but CISA confirmed exploitation on 22 January 2026. In September, F5 reported August scanning that included this flaw and sought cloud credentials and configuration files. Those observations do not establish which organisations lost secrets or whether cloud accounts were subsequently compromised. As of 3 November 2026, fixes remain available; updating does not invalidate credentials already exposed. Vite’s current advisory rates the flaw high at 8.9 under CVSS 4.0, while NVD gives it 7.5 under CVSS 3.1.
- What
- Flaw
- Affects
- Vite development server
- Affected
- Vite <=4.5.10
Vite >=5.0.0, <=5.4.15
Vite >=6.0.0, <=6.0.12
Vite >=6.1.0, <=6.1.2
Vite >=6.2.0, <=6.2.3
Only applications explicitly exposing the Vite development server to the network are affected. - Fixed in
- 4.5.11
5.4.16
6.0.13
6.1.3
6.2.4 - Since
- 22 Jan 2026
- Closed
- 11 Sept 2026
Timeline
- Wider attacks
F5 reported August scanning for AWS credentials, Azure tokens and other secrets on exposed Vite servers, including attempts matching this flaw. The wider campaign generated 807 grouped attacks and roughly 32,000 events across several Vite vulnerabilities, not this CVE alone.
- CISA added
CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming exploitation. Its remediation deadline for covered US federal agencies was 12 February 2026.
- Made publicFixed
Vite disclosed CVE-2025-31125, which lets attackers read restricted files through network-exposed development servers. Fixes were available in 4.5.11, 5.4.16, 6.0.13, 6.1.3 and 6.2.4.
Sources
- server.fs.deny bypassed for inline and raw with ?import queryVite · 31 Mar 2025
- CVE-2025-31125 DetailNIST NVD · 31 Mar 2025
- CISA confirms active exploitation of four enterprise software bugsBleepingComputer · 23 Jan 2026
- Cloud Takeover: Mass Scanning for Exposed Vite Endpoints (CVE-2026-39364)F5 Labs · 11 Sept 2026
- Hackers target exposed Vite dev servers to steal AWS, Azure secretsBleepingComputer · 14 Sept 2026