GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows

• npm vite: >= 7.1.0, < 7.1.11 → fixed in 7.1.11 • npm vite: >= 7.0.0, < 7.0.8 → fixed in 7.0.8 • npm vite: >= 6.0.0, < 6.4.1 → fixed in 6.4.1 • npm vite: >= 2.9.18, < 5.4.21 → fixed in 5.4.21 • npm vite: >= 3.2.9, < 5.4.21 → fixed in 5.4.21 • npm vite: >= 4.5.3, < 5.4.21 → fixed in 5.4.21 • npm vite: >= 5.2.6, < 5.4.21 → fixed in 5.4.21

Summary Files denied by `server.fs.deny` were sent if the URL ended with `\` when the dev server is running on Windows. Impact Only apps that match the following conditions are affected: • explicitly exposes the Vite dev server to the network (using --host or `server.host` config option) • running the dev server on Windows Details `server.fs.deny` can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns). These patterns were able to bypass by using a back slash(`\`). The root cause is that `fs.readFile('/foo.png/')` loads `/foo.png`. PoC ```shell npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env\ http://localhost:5173 ```