diff --git a/app/core/service/PackageVersionFileService.ts b/app/core/service/PackageVersionFileService.ts
index 0b7426c7..5ea40ff7 100644
--- a/app/core/service/PackageVersionFileService.ts
+++ b/app/core/service/PackageVersionFileService.ts
@@ -116,7 +116,11 @@ export class PackageVersionFileService extends AbstractService {
     if (!pkgConfig?.version) {
       throw new ForbiddenError(`"${fullname}" is not allow to unpkg files, see ${unpkgWhiteListUrl}`);
     }
-    if (pkgConfig.version !== '*' && !semver.satisfies(pkgVersion, pkgConfig.version)) {
+
+    // satisfies 默认不会包含 prerelease 版本
+    // https://docs.npmjs.com/about-semantic-versioning#using-semantic-versioning-to-specify-update-types-your-package-can-accept
+    // [x, *] 代表任意版本，这里统一通过 semver 来判断
+    if (!semver.satisfies(pkgVersion, pkgConfig.version, { includePrerelease: true })) {
       throw new ForbiddenError(`"${fullname}@${pkgVersion}" not satisfies "${pkgConfig.version}" to unpkg files, see ${unpkgWhiteListUrl}`);
     }
   }
diff --git a/test/port/controller/PackageVersionFileController/listFiles.test.ts b/test/port/controller/PackageVersionFileController/listFiles.test.ts
index 402ac3af..a3b475d3 100644
--- a/test/port/controller/PackageVersionFileController/listFiles.test.ts
+++ b/test/port/controller/PackageVersionFileController/listFiles.test.ts
@@ -940,6 +940,9 @@ describe('test/port/controller/PackageVersionFileController/listFiles.test.ts',
               bar: {
                 version: '1.0.0',
               },
+              baz: {
+                version: '*',
+              },
             },
           },
         });
@@ -988,6 +991,25 @@ describe('test/port/controller/PackageVersionFileController/listFiles.test.ts',
         assert.equal(res.status, 200);
         assert(res.body.name);
 
+        pkg = await TestUtil.getFullPackage({
+          name: 'baz',
+          version: '0.3.0-rc15',
+          versionObject: {
+            description: 'work with utf8mb4 💩, 𝌆 utf8_unicode_ci, foo𝌆bar 🍻',
+          },
+        });
+        await app.httpRequest()
+          .put(`/${pkg.name}`)
+          .set('authorization', publisher.authorization)
+          .set('user-agent', publisher.ua)
+          .send(pkg)
+          .expect(201);
+        res = await app.httpRequest()
+          .get('/baz/0.3.0-rc15/files/package.json')
+          .expect('content-type', 'application/json; charset=utf-8');
+        assert.equal(res.status, 200);
+        assert(res.body.name);
+
         pkg = await TestUtil.getFullPackage({
           name: 'bar',
           version: '0.3.0-rc15',