Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Description

Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in [email protected], [email protected], [email protected], and [email protected]. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.

Scores

EPSS (exploitation in 30 days)

0.78% · top 44% of all CVEs (4 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-178: Improper Handling of Case Sensitivity (opens in a new tab)All about CWE-178 and its CVEs
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs
• CWE-284: Improper Access Control (opens in a new tab)All about CWE-284 and its CVEs

Affected products

• vitejs · vite

  • affected >=2.7.0, < 2.9.17
  • affected >=3.0.0, <3.2.8
  • affected >=4.0.0, < 4.5.2
  • affected >=5.0.0, < 5.0.12

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmviteGHSA-c24v-8rfc-w8vw (opens in a new tab)

References (3)

• https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5 (opens in a new tab)x_refsource_MISCx_transferred
• https://vitejs.dev/config/server-options.html#server-fs-deny (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-c24v-8rfc-w8vw (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-23331](https://trackcve.app/badge/CVE-2024-23331.svg)](https://trackcve.app/cve/CVE-2024-23331)

Record last updated 17 Jun 2025, 21:19 UTC.