CVE-2026-27730
📋 TL;DR
CVE-2026-27730 is a Server-Side Request Forgery (SSRF) vulnerability in esm.sh's fetch route that allows attackers to bypass hostname-based validation using DNS alias domains. This enables external requesters to make the esm.sh server fetch internal localhost services. Anyone using esm.sh versions up to 137 is affected.
💻 Affected Systems
- esm.sh
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal services, steal credentials, pivot to internal networks, or execute arbitrary code on internal systems.
Likely Case
Information disclosure from internal services, enumeration of internal network resources, and potential data exfiltration.
If Mitigated
Limited to reconnaissance of internal services with proper network segmentation and egress filtering in place.
🎯 Exploit Status
Exploitation requires only HTTP requests with DNS alias domains to bypass hostname validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r
Restart Required: Yes
Instructions:
No official patch available. Monitor the vendor advisory for updates and patch immediately when available.
🔧 Temporary Workarounds
Disable vulnerable fetch route
allTemporarily disable the /http(s) fetch route in esm.sh configuration
Modify esm.sh configuration to disable the vulnerable endpoint
Network egress filtering
allImplement strict egress filtering to prevent esm.sh from accessing internal networks
Configure firewall rules to block esm.sh from initiating connections to internal IP ranges
🧯 If You Can't Patch
- Implement strict network segmentation to isolate esm.sh from sensitive internal services
- Deploy a WAF with SSRF protection rules to block malicious requests
🔍 How to Verify
Check if Vulnerable:
Check if esm.sh version is ≤137 and the /http(s) fetch route is enabledCheck Version:
Check esm.sh server logs or configuration for version informationVerify Fix Applied:
Test if DNS alias domains can no longer bypass hostname validation when making requests📡 Detection & Monitoring
Log Indicators:
- Unusual DNS alias domain requests to /http(s) endpoints
- Requests to internal IP addresses from esm.sh
Network Indicators:
- esm.sh server making outbound connections to internal IP ranges
- DNS queries for localhost aliases
SIEM Query:
source="esm.sh" AND (url_path="/http" OR url_path="/https") AND (dns_query="localhost" OR dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16)