Skip to content
OpenAdvisories
Medium · 5.9 CVE-2024-31207 EUVD-2024-1159GHSA-8jhw-289h-jh2g

Vite's `server.fs.deny` did not deny requests for patterns with directories

Published Apr 4, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: vitejs Product: vite Package: vite Ecosystem: npm

Description

Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.

Affected products

VendorProductAffectedFixed
vitejs vite >= 2.7.0, <= 2.9.17, >= 3.0.0, <= 3.2.8, >= 4.0.0, <= 4.5.2, >= 5.0.0, <= 5.0.12, >= 5.1.0, <= 5.1.6, >= 5.2.0, <= 5.2.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed velociraptor 0.7.0.4.git142.862ef23-1.1 openSUSE-SU-2025:14663-1

Affected packages

EcosystemPackageAffectedFixedRecord
npm vite >= 2.7.0, < 2.9.18 2.9.18 GHSA-8jhw-289h-jh2g
npm vite >= 3.0.0, < 3.2.10 3.2.10 GHSA-8jhw-289h-jh2g
npm vite >= 4.0.0, < 4.5.3 4.5.3 GHSA-8jhw-289h-jh2g
npm vite >= 5.0.0, < 5.0.13 5.0.13 GHSA-8jhw-289h-jh2g
npm vite >= 5.1.0, < 5.1.7 5.1.7 GHSA-8jhw-289h-jh2g
npm vite >= 5.2.0, < 5.2.6 5.2.6 GHSA-8jhw-289h-jh2g

Advisories 1

References