CVE-2026-112946

Avoid exposing the Vite development server to external networks and restrict access to sensitive host paths.

1. Bind the development server to localhost:
Ensure the Vite development server does not listen on public interfaces by omitting the `--host` CLI flag or setting the host explicitly in `vite.config.js`:

javascript
export default {
  server: {
    host: '127.0.0.1'
  }
};

2. Deny sensitive filesystem paths:
Configure `server.fs.deny` in `vite.config.js` to block requests for sensitive system files and directories:

javascript
export default {
  server: {
    fs: {
      deny: ['/etc/**', '/root/**', '/home/**']
    }
  }
};

3. Restrict network access via firewall:
If the server must run on a networked machine, restrict network access to the development port (default 5173):

bash
firewall-cmd --permanent --remove-port=5173/tcp
firewall-cmd --reload

Caveats: Binding strictly to localhost prevents remote access to development previews. Restricting filesystem paths via `server.fs.deny` can block legitimate project dependencies if located in denied paths. Reloading the firewall configuration will momentarily interrupt active connections.