GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

• npm vite: >= 8.3.0, < 8.3.3 → fixed in 8.3.3 • npm vite: >= 8.2.0, < 8.2.4 → fixed in 8.2.4 • npm vite-plus: >= 0.2.8, < 1.1.0 → fixed in 1.1.0

Summary The first 4 bytes of files outside of `server.fs` setting can be returned to the browser by a request containing `?vite-wasm-instance`. Impact Only apps that match one of the following conditions are affected: • explicitly expose the Vite dev server to the network using `--host` or the `server.host` option • there's a file that has a sensitive information in the first 4 bytes • uses Node.js or Deno to run Vite (if Bun is used, it is not affected) Details Requests containing the `?vite-wasm-instance` query are handled by the internal Wasm plugin's `load` hook. The hook removes the query and reads the resulting path directly from disk, but the `server.fs` checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. PoC Create a denied file and start an affected Vite dev server: ```bash echo 'SECRET_KEY=abc123\n' > .env npm run dev curl 'http://localhost:5173/.env?vite-wasm-instance' ``` This will show ``` Failed to parse WASM file "/.env": WebAssembly.compile(): expected magic word 00 61 73 6d, found 53 45 43 52 @+0 ```