GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root

• npm vite: >= 6.3.0, < 6.3.4 → fixed in 6.3.4 • npm vite: >= 6.2.0, < 6.2.7 → fixed in 6.2.7 • npm vite: >= 6.0.0, < 6.1.6 → fixed in 6.1.6 • npm vite: >= 5.0.0, < 5.4.19 → fixed in 5.4.19 • npm vite: < 4.5.14 → fixed in 4.5.14

Summary The contents of files in the project `root` that are denied by a file matching pattern can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project `root` and are denied by a file matching pattern can be bypassed. • Examples of file matching patterns: `.env`, `.env.*`, `*.{crt,pem}`, `/.env` • Examples of other patterns: `/.git/`, `.git/`, `.git/**/*` Details `server.fs.deny` can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (`/.`). PoC ``` npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env/. http://localhost:5173 ```