CVE-2026-27730 - Vulnerability Analysis

Overview

esm.sh <= 137 contains a server side request forgery caused by hostname string validation bypass in /http(s) fetch route, letting external attackers make the server fetch internal localhost services, exploit requires network access.

Severity & Score

Impact

Attackers can make the server perform unauthorized internal network requests, potentially accessing sensitive internal services.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner