vite allows server.fs.deny bypass via backslash on Windows
Published 20 Oct 2025 · Updated 10 Sept 2026
Affected packages
- Affected
- >=7.1.0 <7.1.11
- Fixed in
- 7.1.11
npm install vite@7.1.11- Affected
- >=7.0.0 <7.0.8
- Fixed in
- 7.0.8
npm install vite@7.0.8- Affected
- >=6.0.0 <6.4.1
- Fixed in
- 6.4.1
npm install vite@6.4.1- Affected
- >=2.9.18 <5.4.21
- Fixed in
- 5.4.21
npm install vite@5.4.21- Affected
- >=3.2.9 <5.4.21
- Fixed in
- 5.4.21
npm install vite@5.4.21- Affected
- >=4.5.3 <5.4.21
- Fixed in
- 5.4.21
npm install vite@5.4.21- Affected
- >=5.2.6 <5.4.21
- Fixed in
- 5.4.21
npm install vite@5.4.21Details
Summary
Files denied by `server.fs.deny` were sent if the URL ended with \ when the dev server is running on Windows.
Impact
Only apps that match the following conditions are affected:
- explicitly exposes the Vite dev server to the network (using --host or `server.host` config option)
- running the dev server on Windows
Details
server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.
PoC
npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env\ http://localhost:5173
<img width="1593" height="616" alt="image" src="https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175" />
Is GHSA-93m4-6634-74q7 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected vite, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.