GHSA-8jhw-289h-jh2g Vite's `server.fs.deny` did not deny requests for patterns with directories.

• npm vite: >= 2.7.0, < 2.9.18 → fixed in 2.9.18 • npm vite: >= 3.0.0, < 3.2.10 → fixed in 3.2.10 • npm vite: >= 4.0.0, < 4.5.3 → fixed in 4.5.3 • npm vite: >= 5.0.0, < 5.0.13 → fixed in 5.0.13 • npm vite: >= 5.1.0, < 5.1.7 → fixed in 5.1.7 • npm vite: >= 5.2.0, < 5.2.6 → fixed in 5.2.6

Summary Vite dev server option `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`. Impact Only apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Patches Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] Details `server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes dotfiles not to be denied unless they are explicitly defined. Reproduction Set fs.deny to `['/.git/']` and then curl for `/.git/config`. • with `matchBase: true`, you can get any file under `.git/` (config, HEAD, etc). • with `matchBase: false`, you cannot get any file under `.git/` (config, HEAD, etc).