CVE-2025-50180 in esm.sh
Summary
by MITRE • 02/25/2026
esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/28/2026
The vulnerability identified as CVE-2025-50180 affects esm.sh, a popular no-build content delivery network designed to serve web development packages without requiring local build processes. This CDN operates by proxying requests to external package sources while maintaining a cache of downloaded modules, making it a critical component in modern web development workflows where developers rely on seamless package delivery and caching mechanisms. The vulnerability manifests in version 136 of the service, where the proxy implementation fails to properly validate or sanitize incoming requests, creating a pathway for malicious actors to exploit the system's network communication capabilities.
The technical flaw represents a full-response server-side request forgery vulnerability classified under CWE-918, which allows attackers to manipulate the proxy service into making arbitrary HTTP requests to internal systems that would normally be inaccessible from the public internet. This occurs because the esm.sh service does not adequately filter or restrict the target URLs that can be requested through its proxy interface, enabling attackers to specify internal IP addresses or hostnames that the service should fetch content from. The vulnerability specifically affects the HTTP request handling logic within the proxy component, where user-provided URLs are directly used to construct requests to upstream servers without proper validation or sanitization of the target endpoints.
The operational impact of this vulnerability is significant as it provides attackers with the ability to perform reconnaissance and potentially extract sensitive information from internal networks that are normally protected by firewalls and network segmentation. An attacker could leverage this vulnerability to probe internal services, access internal APIs, retrieve configuration files, or even attempt to exploit other vulnerabilities present on internal systems that are not directly exposed to the internet. This creates a dangerous attack surface where the CDN itself becomes a potential entry point for lateral movement within an organization's network infrastructure, particularly concerning web applications that rely on esm.sh for their package delivery mechanisms.
Mitigation strategies should focus on implementing proper input validation and URL sanitization within the proxy service to ensure that only authorized external domains can be accessed through the CDN. Organizations should immediately upgrade to version 137 or later, which includes the necessary patches to address the SSRF vulnerability. Additionally, network segmentation measures should be implemented to isolate the CDN service from internal systems, and access controls should be configured to restrict the types of requests that can be made through the proxy. The fix aligns with ATT&CK technique T1190, which addresses server-side request forgery vulnerabilities, and should be implemented as part of a comprehensive security posture that includes monitoring for unusual proxy activity and implementing network-level controls to prevent unauthorized internal access attempts.