A critical Server-Side Request Forgery vulnerability in esm.sh allows unauthenticated attackers to access internal network services, posing a significant risk to internal infrastructure security.

The application is susceptible to Server-Side Request Forgery (CWE-918) within the /http(s) fetch route, where insufficient hostname validation allows an unauthenticated user to force the server to communicate with restricted internal resources.

The ability to perform Server-Side Request Forgery can lead to the unauthorized exposure of sensitive internal data and the potential compromise of backend services that are not intended to be publicly accessible. Given the CVSS score of 8.6, this vulnerability represents a high-severity risk that could facilitate further lateral movement within the network, potentially leading to a broader breach of sensitive organizational assets.

Immediate Action: Update the esm.sh service to the version containing the fix, specifically the commit version 0.0.0-20250616164159-0593516c4cfa, to remediate the underlying validation flaw.

Proactive Monitoring: Review web server access logs for anomalous requests to the /http or /https endpoints that attempt to resolve or access internal hostnames or suspicious IP ranges.

Compensating Controls: Implement strict egress filtering on the server hosting esm.sh to prevent the application from initiating connections to internal network segments or unauthorized external endpoints.

Public Exploit Available: Unknown

This vulnerability presents a clear path for attackers to probe internal networks by abusing the functionality of the esm.sh service. Administrators must prioritize updating to the specified fixed version immediately to close the validation gap. If an immediate update is not feasible, restrict the service's ability to communicate with internal network ranges via network-level controls to prevent unauthorized access.