Vite's `server.fs.deny` did not deny requests for patterns with directories.

Description

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.2.0, <= 5.2.5

  >= 5.1.0, <= 5.1.6

  >= 5.0.0, <= 5.0.12

  >= 4.0.0, <= 4.5.2

  >= 3.0.0, <= 3.2.8

  >= 2.7.0, <= 2.9.17**

• Patched version(s): **5.2.6

  5.1.7

  5.0.13

  4.5.3

  3.2.10

  2.9.18**

References

• GHSA-8jhw-289h-jh2g
• CVE-2024-31207
• CWE-200
• CWE-284
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem - CVE-2024-23331
• Vite's `server.fs.deny` is bypassed when using `?import&raw` - CVE-2024-45811
• Vite has an `server.fs.deny` bypass with an invalid `request-target` - CVE-2025-32395
• Vite allows server.fs.deny to be bypassed with .svg or relative paths - CVE-2025-31486

Tags:

npm

vite