Vite's `server.fs.deny` did not deny requests for patterns with directories.

Description

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.2.0, <= 5.2.5

  >= 5.1.0, <= 5.1.6

  >= 5.0.0, <= 5.0.12

  >= 4.0.0, <= 4.5.2

  >= 3.0.0, <= 3.2.8

  >= 2.7.0, <= 2.9.17**

• Patched version(s): **5.2.6

  5.1.7

  5.0.13

  4.5.3

  3.2.10

  2.9.18**

References

• GHSA-8jhw-289h-jh2g
• CVE-2024-31207
• CWE-200
• CWE-284
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - CVE-2025-65944
• vite allows server.fs.deny bypass via backslash on Windows - CVE-2025-62522
• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) - CVE-2020-28500
• Vite middleware may serve files starting with the same name with the public directory - CVE-2025-58751

Tags:

npm

vite