Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@cloudflare/vite-plugin

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9npmAmendedPublished

    Cloudflare Vite plugin exposes secrets over the built-in dev server

    CVE-2025-59427 · GHSA-4pfg-2mw5-f8jx

    Affected
    • npm @cloudflare/vite-plugin < 1.6.0
    Fixed in
    1.6.0· Vendor fix available
    Issue
    Note: originally posted on H1 but closed. Cross-posting over to here in abundance of caution instead of a public issue. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as: - .env - .dev.vars PoC 1. Create a Workers project that utilises the @cloudflare/vite-plugin. For example: - npm create cloudflare@latest - select Framework Starter - React 2. Add any secret files to test if they're accessible. echo foobar=secret .dev.vars for example 3. Run npm run dev to start the dev server (after running npm ci if necessary to install dependencies) and then hit the following to expose information: curl http://localhost:5173/.env may expose any secrets in this file curl http://localhost:5173/.dev.vars may expose any secrets in this file curl http://localhost:5173/package.json may expose dependencies used by the project, potentially leading to…

    Recommended action: Upgrade to 1.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →