CVE-2025-59427: Cloudflare vite plugin exposes secrets over the built-in dev server
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59427?
CVE-2025-59427 has a severity rating of high due to the exposure of sensitive files.
How do I fix CVE-2025-59427?
To fix CVE-2025-59427, ensure that the Cloudflare Vite plugin is configured to restrict access to sensitive files.
Which versions of Cloudflare Vite plugin are affected by CVE-2025-59427?
CVE-2025-59427 affects all versions of the Cloudflare Vite plugin up to and including version 1.6.0.
What happens if CVE-2025-59427 is not addressed?
If CVE-2025-59427 is not addressed, sensitive information in the root directory may be accessible to unauthorized users.
Where can I find more information about CVE-2025-59427?
More information about CVE-2025-59427 can typically be found in security advisories and vulnerability databases.