{"id":"CVE-2024-31207","aliases":["GHSA-8jhw-289h-jh2g"],"url":"https://o3.security/vulnerability/CVE-2024-31207","summary":"Vite's `server.fs.deny` did not deny requests for patterns with directories","details":"Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.","published":"2024-04-04T15:51:54.683Z","modified":"2026-08-12T03:51:15.375245410Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"vite","fixedVersion":"2.9.18"},{"ecosystem":"npm","name":"vite","fixedVersion":"3.2.10"},{"ecosystem":"npm","name":"vite","fixedVersion":"4.5.3"},{"ecosystem":"npm","name":"vite","fixedVersion":"5.0.13"},{"ecosystem":"npm","name":"vite","fixedVersion":"5.1.7"},{"ecosystem":"npm","name":"vite","fixedVersion":"5.2.6"}],"fix":{"url":"https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","label":"vitejs/vite@011bbca"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31207.json"},{"type":"ADVISORY","url":"https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31207"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:15.375245410Z"}}