▶ vite.server.fs.strict has been disabled! Files on your m

Error message

▶ vite.server.fs.strict has been disabled!
  Files on your machine are likely accessible on your network.

What it means

Vite's dev server normally restricts which files it will serve (server.fs.strict). Your config disables that restriction, so any file the process can read — including files outside the project root — becomes fetchable through the dev server; combined with a network-exposed host this can expose your machine's files to the network.

Source

Thrown at packages/astro/src/core/dev/dev.ts:153

	restart.bindCLIShortcuts();
	logger.info(
		'SKIP_FORMAT',
		msg.serverStart({
			startupTime: performance.now() - devStart,
			resolvedUrls: restart.container.viteServer.resolvedUrls || { local: [], network: [] },
			host: restart.container.settings.config.server.host,
			base: restart.container.settings.config.base,
			astroVersionProvider: new BuildTimeAstroVersionProvider(),
			textStyler: piccoloreTextStyler,
		}),
	);

	if (isPrerelease) {
		logger.warn('SKIP_FORMAT', msg.prerelease({ currentVersion }));
	}
	if (restart.container.viteServer.config.server?.fs?.strict === false) {
		logger.warn('SKIP_FORMAT', msg.fsStrictWarning());
	}

	logger.info(null, colors.green('watching for file changes...'));

	return {
		address: devServerAddressInfo,
		get resolvedUrls() {
			return restart.container.viteServer.resolvedUrls || { local: [], network: [] };
		},
		get watcher() {
			return restart.container.viteServer.watcher;
		},
		handle(req, res) {
			return restart.container.handle(req, res);
		},
		async stop() {
			await restart.container.close();
		},

View on GitHub (pinned to e294953aa8)

Solutions

Remove fs.strict: false and instead add the extra directories to vite.server.fs.allow
If you must disable strict mode, never combine it with --host or network exposure
Keep any files the dev server needs under the project root

Example fix

// before — astro.config.mjs
export default defineConfig({
  vite: { server: { fs: { strict: false } } },
});

// after — allow only the specific extra directory
export default defineConfig({
  vite: { server: { fs: { allow: ['.', '../packages/shared'] } } },
});

Defensive patterns

Strategy: validation

Validate before calling

// fail when fs restrictions are relaxed on a network-exposed dev server
const vite = config.vite ?? {};
if (vite.server?.fs?.strict === false && config.server?.host) {
  throw new Error('fs.strict=false with exposed host risks file disclosure');
}

Prevention

Prefer server.fs.allow lists over disabling strict mode
Never run dev with --host together with fs.strict: false
Run the dev server bound to localhost unless sharing is deliberate

When it happens

Trigger: astro.config sets vite: { server: { fs: { strict: false } } } (often to serve files from outside the workspace) while running `astro dev`, especially with --host / server.host binding to 0.0.0.0.

Common situations: Monorepo setups importing assets from sibling workspaces outside the project root; copy-pasting 'fix import errors' snippets from the web; sharing a dev server on a shared or public network.

Related errors

AI-assisted analysis of withastro/astro@e294953aa8 (2026-08-18). Data as JSON: /api/errors/b29aee26a76943e5. Report an issue: GitHub.