Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vitejs/vite

              main @ dae9bb1
            

Fixes

CVEs

HIGH

Peak severity

40.0%

Coverage

Highlights

Path Traversal: 33 prior fixes. Scrutinize any change in this area.

packages/vite/src/node/server/middlewares/static.ts: most-fixed (16 issues). Treat as high-risk during review.

30 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The static file-serving middleware has been repeatedly bypassed via NTFS alternate data streams, double-encoded paths, duplicate leading slashes, and Windows 8.3 short names, allowing arbitrary local file exposure.

Path Traversal: The transform middleware routinely failed to enforce directory boundaries when processing raw queries, inline import parameters, sourcemaps, and trailing query separators, allowing attackers to read restricted local files.

DNS Rebinding: Development and preview servers are susceptible to DNS Rebinding attacks if they fail to validate host headers against allowed configuration patterns.