| Package | Affected versions | Patched versions |
|---|---|---|
| vite | ≥ 7.0.0, ≤ 7.3.1≥ 8.0.0, ≤ 8.0.4 | |
| vite+ | ≤ 0.1.15 | |
| vite | ≥ 7.1.0, < 7.3.2≥ 8.0.0, < 8.0.5 | 7.3.28.0.5 |
The contents of files that are specified by server.fs.deny can be returned to the browser.
Only apps that match the following conditions are affected:
--host or server.host config option)server.fs.allowserver.fs.denyOn the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.
pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPortserver.fs.deny is enforced (expect 403): curl -i http://127.0.0.1:5175/src/.env | head -n 20
<img width="3944" height="1092" alt="image" src="https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f" />Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free