What is the CVSS score of CVE-2026-27730?

CVE-2026-27730 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of DNS are affected by CVE-2026-27730?

esm.sh, a widely-used CDN for web development, contains a Server-Side Request Forgery (SSRF) vulnerability that could allow attackers to access internal systems and data through the `/http(s)` fetch…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27730?

Yes, a public proof-of-concept exploit is available for CVE-2026-27730. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27730?

Within 24 hours: Identify all internal applications and services using esm.sh and assess exposure to the `/http(s)` endpoint; implement network-level access controls to restrict esm.sh from reaching internal systems. Within 7 days: Deploy WAF rules to block suspicious `/http(s)` requests and monitor for exploitation attempts; evaluate alternative CDN providers or maintained esm.sh forks. Within 30 days: Execute migration to patched version once available or alternative CDN solution; conduct forensic review of logs for indicators of compromise.

DNS CVE-2026-27730

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-02-25 security-advisories@github.com

GHSA-p2v6-84h2-5x4r

DNS SSRF Esm.Sh Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 17:43 vuln.today

Public exploit code

CVE Published

Feb 25, 2026 - 16:23 nvd

HIGH 7.5

DescriptionGitHub Advisory

esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s /http(s) fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.

AnalysisAI

esm.sh versions up to 137 contain an SSRF vulnerability in the /http(s) fetch route that allows remote attackers to bypass hostname validation through DNS alias domains and access internal localhost services. Public exploit code exists for this vulnerability, and no patches are currently available. This affects users of esm.sh CDN services and any applications relying on the affected versions.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Esm.Sh. esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s /http(s) fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.