CVE-2026-27730
High
Description
esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.
SeverityHigh
CVSS7.5
Exploit probability—
ProductEsm.sh
PublishedFeb 25, 2026
First seenFeb 25, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- github.com/esm-dev/esm.sh0.0.0-20250616164159-0593516c4cfa or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| esm esm.sh | v ≤ 137 | — |
| github.com/esm-dev/esm.shGo | v < 0.0.0-20250616164159-0593516c4cfa | 0.0.0-20250616164159-0593516c4cfa |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.