GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths

• npm vite: >= 8.0.0, < 8.0.16 → fixed in 8.0.16 • npm vite: >= 7.0.0, < 7.3.5 → fixed in 7.3.5 • npm vite: < 6.4.3 → fixed in 6.4.3 • npm vite-plus: < 0.1.24 → fixed in 0.1.24

Summary The contents of files that are specified by `server.fs.deny` can be returned to the browser on Windows. Impact Only apps that match the following conditions are affected: • explicitly exposes the Vite dev server to the network (using `--host` or `server.host` config option) • the sensitive file exists in the allowed directories specified by `server.fs.allow` • either of: • the sensitive file exists in an NTFS volume • the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes) Details Vite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. PoC ```bash $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev ``` Access via browser at `http://localhost:5173/.env::$DATA?raw` Example expected result: • `/.env::$DATA?raw` returns the contents of `.env` • `/tls.pem::$DATA?raw` returns the contents of `tls.pem`