High severityNVD Advisory· Published Feb 25, 2026· Updated Feb 25, 2026
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
CVE-2026-27730
Description
esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s /http(s) fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/esm-dev/esm.shGo | < 0.0.0-20250616164159-0593516c4cfa | 0.0.0-20250616164159-0593516c4cfa |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/esm-dev/esm.shpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
< 0.0.0-20250616164159-0593516c4cfa+ 1 more
- (no CPE)range: < 0.0.0-20250616164159-0593516c4cfa
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-p2v6-84h2-5x4rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27730ghsaADVISORY
- github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0ghsaWEB
- github.com/esm-dev/esm.sh/pull/1149ghsaWEB
- github.com/esm-dev/esm.sh/releases/tag/v137ghsaWEB
- github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4rghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.