Low severityOSV Advisory· Published Sep 19, 2025· Updated Apr 15, 2026
CVE-2025-59427
CVE-2025-59427
Description
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@cloudflare/vite-pluginnpm | < 1.6.0 | 1.6.0 |
Affected products
2- Range: @cloudflare/chrome-devtools-patches@0.1.1, @cloudflare/chrome-devtools-patches@0.1.2, @cloudflare/kv-asset-handler@0.3.2, …
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-4pfg-2mw5-f8jxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-59427ghsaADVISORY
- github.com/cloudflare/workers-sdk/commit/0e500720bf70016fa4ea21fc8959c4bd764ebc38nvdWEB
- github.com/cloudflare/workers-sdk/security/advisories/GHSA-4pfg-2mw5-f8jxnvdWEB
- hackerone.com/reports/3117837nvdWEB
News mentions
0No linked articles in our index yet.