CVE-2025-50180

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-50180
esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13 Patch
https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511 Patch
https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0 Patch
https://github.com/esm-dev/esm.sh/pull/1149 Issue Tracking Patch
https://github.com/esm-dev/esm.sh/releases/tag/v137 Product Release Notes
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3c9r-837r-qqm4 Exploit Mitigation Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*
History

27 Feb 2026, 17:44

Type Values Removed Values Added
CPE cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*
First Time Esm
Esm esm.sh
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13 - () https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13 - Patch
References () https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511 - () https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511 - Patch
References () https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0 - () https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0 - Patch
References () https://github.com/esm-dev/esm.sh/pull/1149 - () https://github.com/esm-dev/esm.sh/pull/1149 - Issue Tracking, Patch
References () https://github.com/esm-dev/esm.sh/releases/tag/v137 - () https://github.com/esm-dev/esm.sh/releases/tag/v137 - Product, Release Notes
References () https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3c9r-837r-qqm4 - () https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3c9r-837r-qqm4 - Exploit, Mitigation, Patch, Vendor Advisory

25 Feb 2026, 16:23

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-25 16:23

Updated : 2026-02-27 17:44

NVD link : CVE-2025-50180

Mitre link : CVE-2025-50180

CVE.ORG link : CVE-2025-50180

JSON object : View

Products Affected

esm

  • esm.sh
CWE
CWE-918

Server-Side Request Forgery (SSRF)