Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash (//). This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files.
Steps to Fix. Update Vite: Ensure that you are using the latest version of Vite. Security issues like this are often fixed in newer releases.\n2. Secure the server configuration: In your vite.config.js file, review and update the server configuration options to restrict access to unauthorized requests or directories.
Impact
Only users explicitly exposing the Vite dev server to the network (using --host or the server.host config option) are affected and only files in the immediate Vite project root folder could be exposed.\n\n### Patches\nFixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5 and in the latest minors of the previous two majors, vite@3.2.7 and vite@2.9.16.
Details
Vite serves the application with under the root-path of the project while running on the dev mode. By default, Vite uses the server option fs.deny to protect sensitive files. But using a simple double forward-slash, we can bypass this restriction. \n\n### PoC\n1. Create a new latest project of Vite using any package manager. (here I'm using react and vue templates and pnpm for testing)\n2. Serve the application on dev mode using pnpm run dev.\n3. Directly access the file via url using double forward-slash (//) (e.g: //.env, //.env.local)\n4. The server option fs.deny was successfully bypassed.
Proof Images: 
\n
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | vite | < 2.9.16, >= 3.0.2, < 3.2.7, >= 4.0.0, < 4.0.5, >= 4.1.0, < 4.1.5, >= 4.2.0, < 4.2.3, >= 4.3.0, < 4.3.9 | 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, 4.3.9 |
References
- https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67
- https://nvd.nist.gov/vuln/detail/CVE-2023-34092
- https://github.com/vitejs/vite/pull/13348
- https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32
- https://github.com/vitejs/vite
- https://security.snyk.io/package/npm/vite/3.2.0-beta.4
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-200, CWE-50, CWE-706- Platform
- npm
- Package
vite- Disclosed
- 06.06.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-353f-5xf4-qw67 - CC BY 4.0
Vulnerability history: vite
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 24
- First → latest
- 08.2022 10.2026
- Without a fix
- 0
- Exploited in attacks
- 1
Severity breakdown
- High 8
- Medium 14
- Low 2
Disclosures per year
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 9
- 2026: 8
-
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.