Answer in brief
CVE-2024-31207 records a Medium severity vulnerability in `server.fs.deny` did not deny requests for patterns with directories.. The current sources do not mark it as known exploited. The current feed maps vite (npm), vite (npm), vite (npm), vite (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps vite (npm), vite (npm), vite (npm), vite (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| vitenpm | >=2.7.0,<=2.9.17 | Not reported |
| vitenpm | >=3.0.0,<=3.2.8 | Not reported |
| vitenpm | >=4.0.0,<=4.5.2 | Not reported |
| vitenpm | >=5.0.0,<=5.0.12 | Not reported |
| vitenpm | >=5.1.0,<=5.1.6 | Not reported |
| vitenpm | >=5.2.0,<=5.2.5 | Not reported |
Published upstream
Apr 3, 2024
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Apr 3, 2024
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
### Summary [Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`. ### Impact Only apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected. ### Patches Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] ### Details `server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined. **Reproduction** Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`. * with `matchBase: true`, you can get any file under `.git/` (config, HEAD, etc). * with `matchBase: false`, you cannot get any file under `.git/` (config, HEAD, etc).
Quoted source text, attributed separately from HOL analysis.