The Vite development server option `server.fs.deny` can be bypassed on case-insensitive filesystems, such as Windows, by using case-augmented filenames. This allows an attacker to access files that are intended to be blocked by the deny list. The issue arises because the underlying glob matching is case-sensitive, while the filesystem is not, enabling blacklist bypass. This vulnerability affects Vite versions from 2.7.0 up to but not including 5.0.12 and has been fixed in 5.0.12 and earlier patch releases of prior major versions.