CVE-2026-27730: SSRF in esm.sh

The SSRF vulnerability in esm.sh presents a significant risk because it enables attackers to craft malicious requests that originate from the server itself. By exploiting the /http(s) module route, an attacker can bypass intended security boundaries and access resources that should be inaccessible from external networks. This could include internal APIs, databases, or other sensitive services residing on the same network as the esm.sh server. Successful exploitation could lead to data exfiltration, privilege escalation, or even remote code execution if the accessed internal services are vulnerable. The ability to bypass localhost restrictions is particularly concerning, as it allows attackers to interact with services running on the same machine as esm.sh.

1. Reserved2026-02-23
2. Published2026-02-27
3. Modified2026-03-09
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-27730 is to immediately upgrade to version 0.0.0-20250616164159-0593516c4cfa or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These might include restricting outbound network access from the esm.sh server to only trusted destinations, or implementing strict input validation on the /http(s) module route to prevent malicious URLs. Additionally, monitor access logs for unusual outbound requests originating from the esm.sh server. After upgrading, verify the fix by attempting to access internal resources via the /http(s) route and confirming that access is denied.