SSRF Vulnerability in esm.sh CDN for Web Development

CVE-2026-27730

What is CVE-2026-27730?

The esm.sh service, a no-build CDN for web development, contains a Server-Side Request Forgery (SSRF) vulnerability that affects versions up to and including 137. This vulnerability exists in the /http(s) fetch route, where the service attempts to restrict access to localhost or internal targets. However, the validation process relies on hostname string checks that can be easily circumvented using DNS alias domains. As a result, an external attacker may exploit this loophole to force the esm.sh server to fetch data from internal services that are not intended to be publicly accessible. At the current time, there are no known patched versions available to address this issue.

References