esbuild enables any website to send any requests to the development server and read the response

Description

esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.

Recommendation

Update the esbuild package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.24.2
• Patched version(s): 0.25.0

References

• GHSA-67mh-4wv8-2f99
• CWE-346
• OWASP 2021-A7

Related Issues

• esbuild allows arbitrary file read when running the development server on Windows - Vulnerability
• Opening a malicious website while running a Nuxt dev server could allow read-only access to code - CVE-2025-24361
• @saltcorn/server arbitrary file zip read and download when downloading auto backups - Vulnerability
• Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/webpack-builder - CVE-2025-24361

You might also like:

3 reasons why any website's security is important

These 7 PHP mistakes leave your website open to the hackers

Exploiting Server Version Disclosure

Tags:

npm

esbuild