Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. vite
  4. ›
  5. GHSA-v2wj-q39q-566r

GHSA-v2wj-q39q-566r: Vite: `server.fs.deny` bypassed with queries

April 6, 2026

The contents of files that are specified by server.fs.deny can be returned to the browser.

References

  • github.com/advisories/GHSA-v2wj-q39q-566r
  • github.com/vitejs/vite
  • github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff
  • github.com/vitejs/vite/pull/22160
  • github.com/vitejs/vite/releases/tag/v7.3.2
  • github.com/vitejs/vite/releases/tag/v8.0.5
  • github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r

Code Behaviors & Features

Detect and mitigate GHSA-v2wj-q39q-566r with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 7.1.0 before 7.3.2, all versions starting from 8.0.0 before 8.0.5

Fixed versions

  • 8.0.5
  • 7.3.2

Solution

Upgrade to versions 7.3.2, 8.0.5 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
  • CWE-284: Improper Access Control

Source file

npm/vite/GHSA-v2wj-q39q-566r.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 07 Apr 2026 12:19:47 +0000.