Vite's `server.fs.deny` did not deny requests for patterns with directories.

Description

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.2.0, <= 5.2.5

  >= 5.1.0, <= 5.1.6

  >= 5.0.0, <= 5.0.12

  >= 4.0.0, <= 4.5.2

  >= 3.0.0, <= 3.2.8

  >= 2.7.0, <= 2.9.17**

• Patched version(s): **5.2.6

  5.1.7

  5.0.13

  4.5.3

  3.2.10

  2.9.18**

References

• GHSA-8jhw-289h-jh2g
• CVE-2024-31207
• CWE-200
• CWE-284
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) - CVE-2020-28500
• Vite's `server.fs` settings were not applied to HTML files - CVE-2025-58752
• Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter - CVE-2025-58179
• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064

Tags:

npm

vite