7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27730

CVE-2026-27730: esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route

esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s /http(s) fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27730

CVE-2026-27730:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/esm-dev/esm.sh	go	< 0.0.0-20250616164159-0593516c4cfa	0.0.0-20250616164159-0593516c4cfa

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the /http(s) route of esm.sh, identified as CVE-2026-27730. The core of the issue lies in the isLocalhost function in server/utils.go, which uses inadequate string-based checks to validate hostnames. This allows attackers to bypass the protection by using DNS services like nip.io to create hostnames (e.g., 127.0.0.1.nip.io) that resolve to internal or localhost IP addresses but pass the string validation.

The vulnerable workflow originates in the esmRouter function (server/router.go), which handles the request, calls the flawed isLocalhost check, and then proceeds to fetch content from the user-specified URL using the fetch.FetchClient.

The provided patch (0593516c4cfab49ad3b4900416a8432ff2e23eb0) attempts to mitigate the SSRF risk. The main change is to restrict HTTP redirects. The fetch.NewClient function is updated to accept an allowedHosts map and configures the HTTP client to reject any redirects to hosts not on this list. The esmRouter is changed to supply this allowedHosts map, containing only the host from the user's initial request.

However, the patch does not fix the root cause in isLocalhost. It only addresses SSRF attacks that occur via an HTTP redirect. The vulnerability of a direct request to a malicious, DNS-aliased hostname, as demonstrated in the proof-of-concept, appears to remain. The identified functions are those directly involved in the vulnerable flow and the subsequent mitigation attempt.

Vulnerable functions

esmRouter

server/router.go

This function handles incoming HTTP requests for the `/http(s)` route. It is responsible for parsing the user-provided URL and performing security checks. It uses the vulnerable `isLocalhost` function, and upon a successful (but flawed) validation, it initiates the fetch process. The patch modified this function to create and pass an `allowedHosts` list to the HTTP client to restrict redirects.

isLocalhost

server/utils.go

This function is the root cause of the vulnerability. It performs a string-based check to determine if a hostname is a local or private address. It fails to resolve the hostname to its IP address, allowing it to be bypassed with DNS names that resolve to internal IPs (e.g., `127.0.0.1.nip.io`). This function was not modified by the patch.

fetch.NewClient

internal/fetch/fetch.go

This function creates a new HTTP client. Before the patch, the client would follow redirects by default. The patch modifies this function to accept an `allowedHosts` map and configures a `CheckRedirect` policy on the client. This new policy ensures that any HTTP redirects are only to hosts present in the `allowedHosts` map, thus preventing SSRF via redirects.

fetch.FetchClient.Fetch

internal/fetch/fetch.go

This method executes the HTTP request. It was modified to perform a check against the `allowedHosts` map even for the initial request. This serves as a defense-in-depth measure to ensure the client does not make requests to disallowed hosts.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.