NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

Cloudflare Vite plugin exposes secrets over the built-in dev serverGHSA-4pfg-2mw5-f8jx

Fix: cloudflare/workers-sdk@0e50072

GHSA-4pfg-2mw5-f8jx is a Information Exposure vulnerability in @cloudflare/vite-plugin. A fix is available for @cloudflare/vite-plugin — see the affected versions and patch details below.

Also known asCVE-2025-59427
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for GHSA-4pfg-2mw5-f8jx.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs33th percentile — riskier than 33% of all scored CVEsHighest risk
0.00%0.29%0.59%0.88%0.1%0.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

64other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@cloudflare/vite-pluginnpm
8.4Mdownloads / week

Description

Summary

Note: originally posted on H1 but closed. Cross-posting over to here in abundance of caution instead of a public issue.

When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as:

  • .env
  • .dev.vars

PoC

  1. Create a Workers project that utilises the @cloudflare/vite-plugin. For example:
    • npm create cloudflare@latest - select Framework Starter -> React
  2. Add any secret files to test if they're accessible. echo foobar=secret > .dev.vars for example
  3. Run npm run dev to start the dev server (after running npm ci if necessary to install dependencies) and then hit the following to expose information:

curl http://localhost:5173/.env may expose any secrets in this file curl http://localhost:5173/.dev.vars may expose any secrets in this file curl http://localhost:5173/package.json may expose dependencies used by the project, potentially leading to other vulnerabilities curl http://localhost:5173/README.md may expose internal documentation

Impact

If the vite dev server is exposed on a public network, such as when a user simply uses wrangler to serve their application and doesn't publish to Cloudflare in production, an attacker may be able to acquire secrets that the user doesn't wish to be exposed.

Another common scenario where this could happen is when sharing previews of an application using cloudflared. npm run dev -> share preview with cloudflared -> now all secrets are exposed to the public internet.

Exposing via vite is possible via:

npm run dev -- -- --host 0.0.0.0

The default configuration has no reason to expose information outside of the configured assets directory.

Example:

curl http://somehost/.env may expose secrets curl http://somehost/.dev.vars may expose secrets curl http://somehost/package.json may expose dependencies used by the project, potentially leading to other vulnerabilities curl http://somehost/README.md may expose internal documentation

etc.

Information disclosure to anyone on the same network, or if the dev server is exposed such as via cloudflared as explored here: https://github.com/cloudflare/workers-sdk/discussions/3455#discussioncomment-6165773

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npm@cloudflare/vite-pluginall versions1.6.0npm install @cloudflare/vite-plugin@1.6.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @cloudflare/vite-plugin, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @cloudflare/vite-plugin to 1.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-4pfg-2mw5-f8jx is resolved across your whole dependency graph.

  3. Workarounds

    Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

### Summary Note: [originally posted on H1](https://hackerone.com/reports/3117837) but closed. Cross-posting over to here in abundance of caution instead of a public issue. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as: - `.env` - `.dev.vars` ### PoC 1. Create a Workers project that utilises the `@cloudflare/vite-plugin`. For example: - `npm create cloudflare@latest` - select Framework Starter -> React 2. Add any secret files to test if t
O3 Security · Impact-Aware SCA

Is GHSA-4pfg-2mw5-f8jx in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Cloudflare Vite plugin exposes secrets over the built-in…