Vitest 5 dev server leaked .env files via CVE-2026-112948

A critical file access flaw, CVE-2026-112948, was found in Vitest 5 dev servers: when run with --ui, Browser Mode or api: true, the server overwrote Vite's server.fs.deny array and served .env, .npmrc and .git/config over HTTP. The fix is Vitest 5.0.2 or later, plus an explicit deny list and credential rotation.

• Affects vitest --ui, @vitest/browser and api: true mode
• Cause: server.fs.deny was assigned instead of merged with Vite defaults
• Secrets were readable via a request to http://localhost:51204/@fs/.../.env
• Patched in Vitest 5.0.2; rotate keys and set explicit deny rules