esm.sh is a CDN that fetches JavaScript packages via a public /http(s) route. A flaw (CWE‑918) in that endpoint allows an attacker to bypass the check that blocks localhost and internal targets by using DNS alias domains, turning the service into an SSRF tool capable of requesting internal localhost services. This can expose data or services that should remain private to an external attacker, and as of the time of publication no patched versions are available.

The vulnerable product is esm.sh, maintained by esm-dev, with releases up to and including version 137 affected. No newer versions were available at the time of publication.

The CVSS base score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog. An external attacker can trigger the SSRF by sending HTTP requests to the /http(s) endpoint with crafted URLs, demonstrating a remote network attack vector and relying on the CDN’s ability to resolve arbitrary DNS queries.