{"id":"CVE-2024-31207","aliases":["CLSA-2026-1784683083","CLSA-2026-1789031855","CLSA-2026-1790854813","CLSA-2026-1792163424","CLSA-2026-1792225953","EUVD-2024-1159","GHSA-8jhw-289h-jh2g","openSUSE-SU-2025:14663-1"],"status":"published","title":"Vite's `server.fs.deny` did not deny requests for patterns with directories","description":"Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00711,"percentile":0.539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-284"],"published":"2024-04-03T16:46:17Z","modified":"2026-11-04T10:45:43Z","fixes":[{"ecosystem":"npm","package":"vite","fixed_in":["2.9.18","3.2.10","4.5.3","5.0.13","5.1.7","5.2.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"last_affected":"2.9.17"},{"fixed":"2.9.18"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.2.8"},{"fixed":"3.2.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.5.2"},{"fixed":"4.5.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.0.12"},{"fixed":"5.0.13"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"last_affected":"5.1.6"},{"fixed":"5.1.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"last_affected":"5.2.5"},{"fixed":"5.2.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.2"}]}],"versions":["2.9.18","2.9.18-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.1"}]}],"versions":["4.1.5"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.12-tuxcare.0"},{"fixed":"5.0.12-tuxcare.2"}]}],"versions":["5.0.12","5.0.12-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.4"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.2"}]}],"versions":["2.9.18","2.9.18-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"2.7.0"},{"fixed":"2.9.18"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.2.10"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.13"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"5.1.0"},{"fixed":"5.1.7"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.0"},{"fixed":"5.2.6"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git142.862ef23-1.1"}]}],"bundled":27}],"products":[{"vendor":"vitejs","product":"vite"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31207","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8jhw-289h-jh2g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31207.json","tags":["advisory"]},{"url":"https://github.com/vitejs/vite","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6104","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-31207","title":"Vite's `server.fs.deny` did not deny requests for patterns with directories","description":"Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.","status":"published","published":"2024-04-04T15:51:54.683Z","modified":"2024-08-02T01:46:04.483Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-1159","description":"Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.","status":"published","published":"2024-04-04T15:51:54Z","modified":"2024-08-02T01:46:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:24.625974Z"}],"ghsa":[{"id":"GHSA-8jhw-289h-jh2g","title":"Vite's `server.fs.deny` did not deny requests for patterns with directories.","description":"### Summary\n[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`.\n\n### Impact\nOnly apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Patches\nFixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18\n\n### Details\n`server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined.\n\n**Reproduction**\n\nSet fs.deny to `['**/.git/**']` and then curl for `/.git/config`.\n\n* with `matchBase: true`, you can get any file under  `.git/` (config, HEAD, etc).\n* with `matchBase: false`, you cannot get any file under  `.git/` (config, HEAD, etc).\n","status":"published","published":"2024-04-03T16:46:17Z","modified":"2024-04-04T20:24:28Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:37:42.744468Z"}],"nvd":[{"id":"CVE-2024-31207","description":"Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.","status":"published","published":"2024-04-04T16:15:09.333Z","modified":"2026-06-17T07:27:58.913Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"CVE-2024-31207","title":"Vite's `server.fs.deny` did not deny requests for patterns with directories","description":"Vite (French word for \"quick\", pronounced /vit/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.","status":"published","published":"2024-04-04T15:51:54.683Z","modified":"2026-11-11T10:47:17.868103195Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"GHSA-8jhw-289h-jh2g","title":"Vite's `server.fs.deny` did not deny requests for patterns with directories.","description":"### Summary\n[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`.\n\n### Impact\nOnly apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Patches\nFixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18\n\n### Details\n`server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined.\n\n**Reproduction**\n\nSet fs.deny to `['**/.git/**']` and then curl for `/.git/config`.\n\n* with `matchBase: true`, you can get any file under  `.git/` (config, HEAD, etc).\n* with `matchBase: false`, you cannot get any file under  `.git/` (config, HEAD, etc).\n","status":"published","published":"2024-04-03T16:46:17Z","modified":"2026-09-10T03:50:12.501660467Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"CLSA-2026-1784683083","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 2.9.18-tuxcare.2.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-30T19:46:01.439880797Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1789031855","title":"TuxCare security update for vite (16 CVEs)","description":"TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.","status":"published","published":"2026-09-10T09:17:35Z","modified":"2026-10-15T09:47:55.69239765Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790854813","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.0.12-tuxcare.2.","status":"published","published":"2026-10-01T11:40:13Z","modified":"2026-10-15T09:47:57.661189598Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792163424","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 4.5.0-tuxcare.4.","status":"published","published":"2026-10-16T15:10:24Z","modified":"2026-10-16T16:31:39.757399382Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792225953","title":"TuxCare security update for @vitejs/plugin-react (7 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 7 CVEs. Fixed in 2.9.18-tuxcare.2.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:24.727766679Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"openSUSE-SU-2025:14663-1","title":"velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-17T00:00:00Z","modified":"2026-02-04T03:47:20.18775Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}