Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

影響: npm:@vitest/ui >= 5.0.0-beta.6, < 5.0.5 → 5.0.5, npm:@vitest/browser >= 5.0.0-beta.6, < 5.0.5 → 5.0.5, npm:vite-plus >= 1.0.0-rc.0, < 1.3.0 → 1.3.0

In Vitest 5, Vite's server.fs.deny is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as .env, private keys and certificates, .npmrc, and .git) or Vitest's own API token file (.vitest-secret-token) can be read over plain HTTP by a client that can reach the server. In Browser Mode with test.projects, a malicious website can also read .env values through the developer's browser. This only applies when Vitest runs…

Read on GitHub Advisory Database

On 10/22/2026, 04:57 AM, GitHub Advisory Database published "Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-112948.