CVE-2026-27730
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Feb 25, 2026
CISA due date
—
The record
esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/esm-dev/esm.sh | 0 | 0.0.0-20250616164159-0593516c4cfa |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260317T205859-150000.1.152.1 |
Related vulnerabilities
- GO-2026-4332 esm.sh has a path traversal in extractPackageTarball enables file writes from malicious… Also affects github.com/esm-dev/esm.sh
- GO-2026-4545 esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh Also affects github.com/esm-dev/esm.sh
- CVE-2025-50180 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
- CVE-2026-23644 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
- GO-2025-4138 esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh Also affects github.com/esm-dev/esm.sh
- GO-2025-4139 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in… Also affects github.com/esm-dev/esm.sh
- CVE-2025-65026 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript Also affects github.com/esm-dev/esm.sh
- CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip Also affects github.com/esm-dev/esm.sh