Arbitrary file read when running the development server on Windows
esbuild security advisories
All 3 advisories esbuild has published with an identifier, newest first. Severity is the one its publisher assigned, and the fix is the release the publisher named. Nothing on this page is our judgement.
- Advisories
- 30 carry a CVE
- high
- 1
- medium
- 1
- low
- 1
- Fix in the archive
- 3of 3 matched to a release
- Oldest
- 8 Feb 20251.6 years ago
Every advisory here is matched to the release in the archive that carries its fix. This page is a copy of what the publisher published, kept for reference. The authoritative source for a security question is the publisher, and an advisory missing from here is not evidence that none exists. What this page does and does not tell you sets out the limits in full.
Newest first
Every productMissing binary integrity verification in esbuild Deno module enables remote code execution via NPM_CONFIG_REGISTRY
Any websites were able to send any requests to the development server and read the response