CVE-2024-31207

A flaw was found in the Node.js Vite package. When configuring the “server.fs.deny” server option to deny requests that include a pattern with directories such as /foo/**/*, the requests were still being allowed. This can potentially expose files or directories containing sensitive information. Only apps setting a custom “server.fs.deny” that includes a pattern with directories, and explicitly exposing the Vite dev server to the network using --host or server.host config option are affected.

Mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.