CVE-2026-27730 - Vulnerability Analysis

Overview

esm.sh <= 137 contains a server side request forgery caused by hostname string validation bypass in /http(s) fetch route, letting external attackers make the server fetch internal localhost services, exploit requires network access.

Severity & Score

Impact

Attackers can make the server perform unauthorized internal network requests, potentially accessing sensitive internal services.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2026-27730 - High (8.6) esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the val... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27730/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner