bug: Windows paths containing ~ trigger false "outside of Vite serving allow list" errors #22892

Describe the bug

Reproduction repository

A minimal reproduction is available here:

https://github.com/tanmay-haldar0/vite-path-tilde-repro

To reproduce:

1. Clone the repository.
2. Place it in a directory containing ~, for example:

   D:\code\test~\vite-path-tilde-repro
   

3. Run:

   npm install
   npm run dev

4. Open the local Vite URL.

Reproduction

https://github.com/tanmay-haldar0/vite-path-tilde-repro

Steps to reproduce

1. Create a new Vite project.

npm create vite@latest vite-app
cd vite-app
npm install

2. Move the project into a Windows directory whose path contains the ~ character.

Example:

D:\code\test~\vite-app

3. Start the development server.

npm run dev

4. Open the local development URL shown by Vite (for example, http://localhost:5173/).

5. Observe that Vite responds with:

403 Restricted

The request url ".../index.html" is outside of Vite serving allow list.

6. Move the same project to a path without ~.

Example:

D:\code\vite-app

7. Run:

npm run dev

8. Open the same URL again. The application loads normally.

System Info

System:
    OS: Windows 11 10.0.26200
    CPU: (12) x64 AMD Ryzen 5 5500GT with Radeon Graphics
    Memory: 2.46 GB / 7.37 GB
  Binaries:
    Node: 24.18.0 - C:\Program Files\nodejs\node.EXE
    npm: 11.16.0 - C:\Program Files\nodejs\npm.CMD
  Browsers:
    Chrome: 150.0.7871.47
    Edge: Chromium (150.0.4078.48)

Used Package Manager

npm

Logs

PS D:\code\test~\vite-path-tilde-repro> npx vite --debug

vite:config bundled config file loaded in XXms
vite:env loading env files:
vite:env   D:/code/test~/vite-path-tilde-repro/.env
vite:env   D:/code/test~/vite-path-tilde-repro/.env.local
vite:env   D:/code/test~/vite-path-tilde-repro/.env.development
vite:env   D:/code/test~/vite-path-tilde-repro/.env.development.local
vite:env env files loaded in Xms
vite:config using resolved config:
{
  ...
  root: 'D:/code/test~/vite-path-tilde-repro',
  ...
  server: {
    fs: {
      strict: true,
      allow: [
        'D:/code/test~/vite-path-tilde-repro'
      ]
    }
  }
  ...
}

VITE v8.1.3 ready in XXX ms

➜  Local:   http://localhost:5173/
➜  Network: use --host to expose

The request url "D:/code/test~/vite-path-tilde-repro/index.html" is outside of Vite serving allow list.

- D:/code/test~/vite-path-tilde-repro

Refer to docs https://vite.dev/config/server-options.html#server-fs-allow for configurations and more details.

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.