Vulnerabilities

TI-2026-22092 CVE-2026-27730 · GHSA-p2v6-84h2-5x4r

esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route

HIGH 66

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00386 Published 2026-02-25 Fixed in 0.0.0-20250616164159-0593516c4cfa CWE-918

TI-2025-32063 CVE-2025-50180 · GHSA-3c9r-837r-qqm4

HIGH 77

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00437 Published 2026-02-25 Fixed in 0.0.0-20250616164159-0593516c4cfa CWE-918

TI-2026-19038 CVE-2026-23644 · GHSA-2657-3c98-63jq

MEDIUM 40

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.0056 Published 2026-01-18 Fixed in 0.0.0-20260116051925-c62ab83c589e CWE-22

TI-2025-40212 CVE-2025-65026 · GHSA-hcpf-qv9m-vfgp

HIGH 74

esm.sh is a nobuild content delivery network(CDN) for modern web development.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00514 Published 2025-11-19 Fixed in 136, 0.0.0-20251118065157-87d2f6497574 CWE-94

TI-2025-40211 CVE-2025-65025 · GHSA-h3mw-4f23-gwpw

HIGH 81

esm.sh is a nobuild content delivery network(CDN) for modern web development.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00571 Published 2025-11-19 Fixed in 136, 0.0.0-20251117232647-9d77b88c3207 CWE-22