{"id":"CVE-2024-31207","aliases":["GHSA-8jhw-289h-jh2g"],"url":"https://o3.security/vulnerability/CVE-2024-31207","summary":"Vite's `server.fs.deny` did not deny requests for patterns with directories","details":"### Summary\n[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`.\n\n### Impact\nOnly apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Patches\nFixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18\n\n### Details\n`server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined.\n\n**Reproduction**\n\nSet fs.deny to `['**/.git/**']` and then curl for `/.git/config`.\n\n* with `matchBase: true`, you can get any file under  `.git/` (config, HEAD, etc).\n* with `matchBase: false`, you cannot get any file under  `.git/` (config, HEAD, etc).\n","published":"2024-04-04T15:51:54.683Z","modified":"2026-11-04T10:45:43.090419853Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"vite","fixedVersion":"2.9.18"},{"ecosystem":"npm","name":"vite","fixedVersion":"3.2.10"},{"ecosystem":"npm","name":"vite","fixedVersion":"4.5.3"},{"ecosystem":"npm","name":"vite","fixedVersion":"5.0.13"},{"ecosystem":"npm","name":"vite","fixedVersion":"5.1.7"},{"ecosystem":"npm","name":"vite","fixedVersion":"5.2.6"}],"fix":{"url":"https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","label":"vitejs/vite@011bbca"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31207.json"},{"type":"ADVISORY","url":"https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31207"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258"},{"type":"FIX","url":"https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-04T10:45:43.090419853Z"}}