vitejs/vite · error · Error

envPrefix option contains value '', which could lead unexpec

Error message

envPrefix option contains value '', which could lead unexpected exposure of sensitive information.

What it means

`resolveEnvPrefix` throws when `envPrefix` contains an empty string because an empty prefix matches every key, which would expose the entire `process.env` (DATABASE_URL, tokens, private keys) to client-bundle code. Vite only ships prefixed vars to the client precisely to keep secrets server-side, so the empty-prefix case is treated as a configuration defect. The check lives at env.ts:113.

Source

Thrown at packages/vite/src/node/env.ts:114

  // check if there are actual env variables starting with VITE_*
  // these are typically provided inline and should be prioritized
  for (const key in process.env) {
    if (prefixes.some((prefix) => key.startsWith(prefix))) {
      env[key] = process.env[key]!
    }
  }

  debug?.(`using resolved env: %O`, env)

  return env
}

export function resolveEnvPrefix({
  envPrefix = 'VITE_',
}: UserConfig): string[] {
  envPrefix = arraify(envPrefix)
  if (envPrefix.includes('')) {
    throw new Error(
      `envPrefix option contains value '', which could lead unexpected exposure of sensitive information.`,
    )
  }
  if (envPrefix.some((prefix) => /\s/.test(prefix))) {
    // eslint-disable-next-line no-console
    console.warn(
      colors.yellow(
        `[vite] Warning: envPrefix option contains values with whitespace, which does not work in practice.`,
      ),
    )
  }
  return envPrefix
}

View on GitHub (pinned to 89620f09af)

Solutions

1. Use a concrete prefix such as `envPrefix: 'VITE_'` (default) or a custom one like `'APP_'`.
2. If you need multiple prefixes, list non-empty ones: `envPrefix: ['VITE_', 'APP_']`.
3. Remove any code path that can produce `''` in the prefix array (guard with a fallback).

Example fix

// before
export default defineConfig({ envPrefix: '' })

// after
export default defineConfig({ envPrefix: 'VITE_' })

function assertEnvPrefix(prefix: string | string[]) {
  const arr = Array.isArray(prefix) ? prefix : [prefix]
  if (arr.includes('')) throw new Error('envPrefix must not contain an empty string (exposes all env vars)')
}

function isSafeEnvPrefix(prefix: unknown): prefix is string | string[] {
  const arr = Array.isArray(prefix) ? prefix : [prefix]
  return arr.every((p) => typeof p === 'string' && p.length > 0 && !/\s/.test(p))
}

When it happens

Trigger: Setting `envPrefix: ''`, `envPrefix: ['']`, `envPrefix: ['VITE_', '']`, or passing an array/string that resolves to an empty element in the Vite config.

Common situations: Wanting to expose all env vars without picking a prefix; copy-pasting `envPrefix: process.env.VITE_PREFIX ?? ''`; arrays built dynamically where one branch yields `''`.

Related errors

• "local" cannot be used as a mode name because it conflicts w
• `renderLegacyChunks` and `renderModernChunks` cannot be both
• Invalid environment name "${name}". Environment names must o
• `input` cannot contain glob characters. They are reserved, s
• Required environments configuration were stripped out in the

AI-assisted analysis of vitejs/vite@89620f09af (2026-08-03). Data as JSON: /data/errors/adf787f3256a2df1.json. Report an issue: GitHub.