p PatchFirst

CVE-2025-24010

CVE-2025-24010 · Vite allows any websites to send any requests to the development server and read the response

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6.

CVSS 6.5 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vite

    Versions
    • >= 6.0.0, < 6.0.9: Affected
    • >= 5.0.0, < 5.4.12: Affected
    • < 4.5.6: Affected

    No fix published

  • vite npm

    Affected ranges
    • SEMVER: ≥ 6.0.0, < 6.0.9

    Update to 6.0.9

  • vite npm

    Affected ranges
    • SEMVER: ≥ 5.0.0, < 5.4.12

    Update to 5.4.12

  • vite npm

    Affected ranges
    • SEMVER: < 4.5.6

    Update to 4.5.6

Original sources

Check your server →