ROOT-APP-NPM-GHSA-GV7W-RQVM-QJHR GHSA-gv7w-rqvm-qjhr in esbuild - Patched by Root

Root has patched GHSA-gv7w-rqvm-qjhr in the esbuild package for Root:npm. Multiple fixed versions available...

PT-2026-82646

Root has patched GHSA-gv7w-rqvm-qjhr in the esbuild package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-67MH-4WV8-2F99 GHSA-67mh-4wv8-2f99 in esbuild - Patched by Root

Root has patched GHSA-67mh-4wv8-2f99 in the esbuild package for Root:npm. Multiple fixed versions available...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: etcd, opencost, supercronic, newrelic-k8s-metadata-injection, kafka-proxy, neuvector-scanner, hey, envoy-ratelimit, sriov-network-device-plugin, zot, fluxcd-kustomize-mutating-webhook, tkn, hugo-extended, clickhouse-operator, ghaudit, kyverno-notation-aws,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: k8sgateway, rabbitmq-messaging-topology-operator, bom, minio-object-browser, flux-image-automation-controller, nri-postgresql, opencost, opentofu, src-fingerprint, terraform, wgcf, dex, kube-vip-cloud-provider, crossplane-provider-aws-dynamodb, git-lfs, external-dns,...

SUSE CVE-2026-44594

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...

CLEANSTART-2026-FL75778 Security fixes in esbuild 0.25.0-r0

Package esbuild version 0.25.0-r0 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

PT-2026-55956

Root has patched GHSA-67mh-4wv8-2f99 in the @rootio/esbuild package for Root:npm. Multiple fixed versions available...

GHSA-999R-QQ7V-R334 aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 2.246.0 on Windows might allow a threat actor who...

Resources Downloaded over Insecure Protocol

Overview esbuild is an An extremely fast JavaScript and CSS bundler and minifier. Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol in the installFromNPM process. An attacker can execute arbitrary code with the privileges of the Deno process by...

Resources Downloaded over Insecure Protocol

Overview org.webjars.npm:esbuild is an An extremely fast JavaScript and CSS bundler and minifier. Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol in the installFromNPM process. An attacker can execute arbitrary code with the privileges of the Deno...

NPM: Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

NPM: Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPMCONFIGREGISTRY vulnerability discovered by ? in WordPress Npm esbuild versions = 0.17.0, 0.28.1...

0xradishsdk (>=1.9.0, <=2.0.2), 11th-ui (0.0.0) +28614 more potentially affected by unknown CVE via esbuild (>=0.17.0, <=0.28.0)

esbuild NPM version =0.17.0, =1.9.0, =0.1.0, =0.3.0, =0.0.1, =1.0.0, =1.0.1, =0.0.1, =0.0.4, =0.0.1, =0.0.1, =1.2.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-ESBUILD-17750822...

GHSA-GV7W-RQVM-QJHR Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

Withdrawn Advisory This advisory has been withdrawn because the affected package was incorrectly identified and the actual affected package is not in a supported ecosystem. This link is maintained to preserve external references. Original Description Summary The esbuild Deno module lib/deno/mod.t...

Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

Withdrawn Advisory This advisory has been withdrawn because the affected package was incorrectly identified and the actual affected package is not in a supported ecosystem. This link is maintained to preserve external references. Original Description Summary The esbuild Deno module lib/deno/mod.t...

Directory Traversal

Overview esbuild is an An extremely fast JavaScript and CSS bundler and minifier. Affected versions of this package are vulnerable to Directory Traversal in the servedir process on Windows systems due to improper path normalization. An attacker can access arbitrary files outside the intended...

0xradishsdk (>=1.9.0, <=2.0.2), 2.typescript-init (1.0.0) +5836 more potentially affected by unknown CVE via esbuild (>=0.27.3, <=0.28.0)

esbuild NPM version =0.27.3, =1.9.0, =0.0.1, =0.1.1, =0.1.5, =0.1.0, =1.0.22, =0.1.0, =0.1.6, =0.2.9, =0.0.1, =13.7.0, =0.5.4, =0.0.2, =0.0.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G7R4-M6W7-QQQR...

0xradishsdk (>=1.9.0, <=2.0.2), 2.typescript-init (1.0.0) +5836 more potentially affected by unknown CVE via esbuild (>=0.27.3, <=0.28.0)

esbuild NPM version =0.27.3, =1.9.0, =0.0.1, =0.1.1, =0.1.5, =0.1.0, =1.0.22, =0.1.0, =0.1.6, =0.2.9, =0.0.1, =13.7.0, =0.5.4, =0.0.2, =0.0.5 and more Source cves: unknown CVE Source advisory: SNYK:JS-ESBUILD-17750815...

NPM: esbuild allows arbitrary file read when running the development server on Windows

NPM: esbuild allows arbitrary file read when running the development server on Windows vulnerability discovered by ? in WordPress Npm esbuild versions = 0.27.3, 0.28.1...

esbuild allows arbitrary file read when running the development server on Windows

Summary The development server contains a path traversal vulnerability on Windows when serving files from servedir. Due to the use of path.Clean which only normalizes forward-slash / separators instead of a Windows-aware path normalization function, it is possible to craft requests using...