# CVE-2024-23331: Vite dev server fs.deny bypass via case-insensitive filesystem

Source: https://junglewise.ai/threats/cve-2024-23331-vite-dev-server-fs-deny-bypass-via-case-insensitive-filesystem  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-23331 · Severity: low · CVSS 3.1 · Published 2024-01-19

Vite is a popular build tool and development server used by JavaScript developers. The server's file access restriction setting (`server.fs.deny`) can be bypassed on Windows and other case-insensitive filesystems by requesting files with altered letter casing. An attacker with network access to a dev server can read sensitive files like environment configuration, private keys, and secrets that should be protected.

Technologies: [Vite](https://junglewise.ai/threats/technologies/vite). Vendors: [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2024-23331 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-23331 being exploited in the wild.

**How severe is CVE-2024-23331?** Low severity, with a CVSS score of 3.1, published 19 January 2024.

**Which products and versions are affected?** Vite >=2.7.0 <=2.9.16, >=3.0.0 <=3.2.7, >=4.0.0 <=4.5.1, >=5.0.0 <=5.0.11.

**Is there a fix for CVE-2024-23331?** A patch was published on 2024-01-19: Fixed in vite 2.9.17, 3.2.8, 4.5.2, 5.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-23331 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-23331?** Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a case-sensitivity bypass in file access control (CWE-178, CWE-284, CWE-200). Vite's picomatch glob matcher defaults to case-sensitive matching, but the underlying filesystem on Windows is case-insensitive, creating a mismatch. An attacker can request files using case-augmented paths (e.g., `/custom.sEcReT` instead of `/custom.secret`) to bypass the `server.fs.deny` blacklist. No authentication is required; the attack is network-accessible on exposed dev servers. An attacker gains read access to restricted files including configuration, environment variables, and private keys. Patches are available in vite 2.9.17, 3.2.8, 4.5.2, and 5.0.12.

## Affected products

- Vite Vite >=2.7.0 <=2.9.16, >=3.0.0 <=3.2.7, >=4.0.0 <=4.5.1, >=5.0.0 <=5.0.11

## Identifiers

- CVE-2024-23331
- GHSA-c24v-8rfc-w8vw

## Timeline

- 2024-01-19: disclosed
- 2024-01-19: patched: Fixed in vite 2.9.17, 3.2.8, 4.5.2, 5.0.12

## References

- [https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw](https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vitejs launch-editor NTLM hash disclosure via UNC path handling](https://junglewise.ai/threats/cve-2026-53632-vitejs-launch-editor-ntlm-hash-disclosure-via-unc-path-handling)
- [Vite path traversal and sensitive file disclosure on Windows via NTFS ADS](https://junglewise.ai/threats/cve-2026-53571-vite-path-traversal-and-sensitive-file-disclosure-on-windows-via)