Vite's `server.fs.deny` did not deny requests for patterns with directories
Priority LOW 28CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-284.
Summary
Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00711 53rd percentileScored 2026-11-07
Fix Fixed vite (npm): 2.9.18, 3.2.10, 4.5.3 +3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vitejs | vite | 2.7.0 – 2.9.17; 3.0.0 – 3.2.8; 4.0.0 – 4.5.2; 5.0.0 – 5.0.12; 5.1.0 – 5.1.6; 5.2.0 – 5.2.5 | — | No fix listed | CNA |
| — | vite (npm) | 2.7.0 to before 2.9.18 | 2.9.18 | Patch available | GHSA-8jhw-289h-jh2g |
| — | vite (npm) | 3.0.0 to before 3.2.10 | 3.2.10 | Patch available | GHSA-8jhw-289h-jh2g |
| — | vite (npm) | 4.0.0 to before 4.5.3 | 4.5.3 | Patch available | GHSA-8jhw-289h-jh2g |
| — | vite (npm) | 5.0.0 to before 5.0.13 | 5.0.13 | Patch available | GHSA-8jhw-289h-jh2g |
| — | vite (npm) | 5.1.0 to before 5.1.7 | 5.1.7 | Patch available | GHSA-8jhw-289h-jh2g |
| — | vite (npm) | 5.2.0 to before 5.2.6 | 5.2.6 | Patch available | GHSA-8jhw-289h-jh2g |
- vite Vendorvitejs Affected 2.7.0 – 2.9.17; 3.0.0 – 3.2.8; 4.0.0 – 4.5.2; 5.0.0 – 5.0.12; 5.1.0 – 5.1.6; 5.2.0 – 5.2.5 Fixed in — No fix listed CNA
- vite (npm) Vendor— Affected 2.7.0 to before 2.9.18 Fixed in 2.9.18 Patch available GHSA-8jhw-289h-jh2g
- vite (npm) Vendor— Affected 3.0.0 to before 3.2.10 Fixed in 3.2.10 Patch available GHSA-8jhw-289h-jh2g
- vite (npm) Vendor— Affected 4.0.0 to before 4.5.3 Fixed in 4.5.3 Patch available GHSA-8jhw-289h-jh2g
- vite (npm) Vendor— Affected 5.0.0 to before 5.0.13 Fixed in 5.0.13 Patch available GHSA-8jhw-289h-jh2g
- vite (npm) Vendor— Affected 5.1.0 to before 5.1.7 Fixed in 5.1.7 Patch available GHSA-8jhw-289h-jh2g
- vite (npm) Vendor— Affected 5.2.0 to before 5.2.6 Fixed in 5.2.6 Patch available GHSA-8jhw-289h-jh2g
Remediation
- Fix · GHSA-8jhw-289h-jh2g vite (npm) Fixed in 2.9.18 Advisory →
- Fix · GHSA-8jhw-289h-jh2g vite (npm) Fixed in 3.2.10 Advisory →
- Fix · GHSA-8jhw-289h-jh2g vite (npm) Fixed in 4.5.3 Advisory →
- Fix · GHSA-8jhw-289h-jh2g vite (npm) Fixed in 5.0.13 Advisory →
- Fix · GHSA-8jhw-289h-jh2g vite (npm) Fixed in 5.1.7 Advisory →
- Fix · GHSA-8jhw-289h-jh2g vite (npm) Fixed in 5.2.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-31207
- 2026-10-03 Alias added: GHSA-8jhw-289h-jh2g
References
Other 8
- https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g
- https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0
- https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48
- https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67
- https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9
- https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258
- https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649
- https://github.com/vitejs/vite
More vitejs vulnerabilities
- TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
- TI-2025-41248 Code injection in vitejs vite-plugin-react CVSS 3.1CRITICAL 9.8
- TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
- TI-2025-41735 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVSS 3.1HIGH 7.5
- TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
- TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
Sources
- CVE-2024-31207 · CVE Program
- CVE-2024-31207 · NVD
- FIRST EPSS
- GHSA-8jhw-289h-jh2g · GitHub Advisory Database · CC BY 4.0
- CVE-2024-31207 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences