https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27730.htmlhttps://patchthecve.com/cve/CVE-2026-27730.htmlWed, 17 Jun 2026 10:27:34 +0000HIGH 7.5: esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bhttps://patchthecve.com/cve/CVE-2025-50180.htmlhttps://patchthecve.com/cve/CVE-2025-50180.htmlWed, 17 Jun 2026 09:34:48 +0000HIGH 7.5: esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.https://patchthecve.com/cve/CVE-2026-23644.htmlhttps://patchthecve.com/cve/CVE-2026-23644.htmlWed, 17 Jun 2026 10:21:52 +0000HIGH 7.5: esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does not prevent absolute paths in a malicious tar file.https://patchthecve.com/cve/CVE-2025-65026.htmlhttps://patchthecve.com/cve/CVE-2025-65026.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.1: esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, ehttps://patchthecve.com/cve/CVE-2025-65025.htmlhttps://patchthecve.com/cve/CVE-2025-65025.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.2: esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../..