CVE-2025-59427 Cloudflare vite plugin exposes secrets over the built-in dev server
The Cloudflare Vite plugin exposes sensitive files like .env and .dev.vars via the local dev server, allowing attackers to read secrets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59427?
CVE-2025-59427 is a low-severity vulnerability in cloudflare workers-sdk, published on 19 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
Weakness: CWE-200
Which versions are affected by CVE-2025-59427?
2 open source packages ship an affected version, including @cloudflare/vite-plugin.
| Package | Affected | Fixed in |
|---|---|---|
@cloudflare/vite-plugin npm | All versions | 1.6.0 |
@cloudflare/vite-plugin npm | All versions | 1.6.0 |
How do I fix CVE-2025-59427?
Upgrade @cloudflare/vite-plugin to 1.6.0 or later.
Is CVE-2025-59427 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59427 exists.
Sources
Also known as GHSA-4pfg-2mw5-f8jx.