Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27730 http://esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in http://esm.sh’s `/http(s)` … https://www.cve.org/CVERecord?id=CVE-2026-27730
Post summary
The post announces that CVE‑2026‑27730 is an SSRF vulnerability in esm.sh CDN affecting versions up to 137.
🟠 CVE-2026-27730 - High http://esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in http://esm.sh’s `/http(s)` fetch route. The servic... https://www.thehackerwire.com/vulnerability/CVE-2026-27730/ https://t.co/91n6eZE9JQ
Post summary
CVE-2026-27730 is an SSRF vulnerability in esm.sh CDN affecting versions up to 137, with technical details provided but no PoC, exploit, or patch mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | esm | esm.sh | - | - | - |