CVE-2025-50180 esm.sh is vulnerable to full-response SSRF

What is CVE-2025-50180?

CVE-2025-50180 is a high-severity server-side request forgery vulnerability in esm-dev esm.sh, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.

Weakness: CWE-918

Which versions are affected by CVE-2025-50180?

3 open source packages ship an affected version, including github.com/esm-dev/esm.sh. It affects 1 product.

Products include Esm Esm.sh.

How do I fix CVE-2025-50180?

Upgrade github.com/esm-dev/esm.sh to 0.0.0-20250616164159-0593516c4cfa or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-50180 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-50180 exists.

Other vulnerabilities in esm-dev esm.sh

• CVE-2026-27730 esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route High 8.6
• CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip High 8.2
• CVE-2026-23644 esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages High 7.7
• CVE-2025-65026 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3c9r-837r-qqm4, GO-2026-4545.