ensure correct case is used for static assets

.changeset/pretty-actors-chew.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+ensure static assets are only served if correct case is used

packages/kit/src/core/dev/plugin.js

@@ -195,9 +195,15 @@ export async function create_plugin(config) {
 							const file = config.kit.files.assets + pathname;
 
 							if (fs.existsSync(file) && !fs.statSync(file).isDirectory()) {
-								req.url = encodeURI(pathname); // don't need query/hash
-								asset_server(req, res);
-								return;
+								const has_correct_case = fs
+									.readdirSync(path.dirname(file))
+									.includes(path.basename(file));
+
+								if (has_correct_case) {
+									req.url = encodeURI(pathname); // don't need query/hash
+									asset_server(req, res);
+									return;
+								}
 							}
 						}
 

packages/kit/test/apps/basics/test/test.js

@@ -2570,6 +2570,11 @@ test.describe.parallel('Static files', () => {
 		const response = await request.get(path);
 		expect(response.status()).toBe(200);
 	});
+
+	test('Filenames are case-sensitive', async ({ request }) => {
+		let response = await request.get('/static.JSON');
+		expect(response.status()).toBe(404);
+	});
 });
 
 test.describe.parallel('Matchers', () => {