esbuild (npm)
An extremely fast bundler for the web
Advisories
5
Latest version
0.28.2
Released Aug 8, 2026
License
MIT
OpenSSF Scorecard
5.0 / 10
How to fix
Upgrading to 0.28.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install esbuild@0.28.2yarn
yarn add esbuild@0.28.2pnpm
pnpm add esbuild@0.28.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-gv7w-rqvm-qjhr Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY Withdrawn |
High | >= 0.17.0, < 0.28.1 | 0.28.1 |
| GHSA-gv7w-rqvm-qjhr Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY Withdrawn |
High | >= 0.17.0, < 0.28.1 | 0.28.1 |
| GHSA-g7r4-m6w7-qqqr esbuild allows arbitrary file read when running the development server on Windows |
Low | >= 0.27.3, < 0.28.1 | 0.28.1 |
| GHSA-g7r4-m6w7-qqqr esbuild allows arbitrary file read when running the development server on Windows |
Low | >= 0.27.3, < 0.28.1 | 0.28.1 |
| GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response |
Medium | < 0.25.0 | 0.25.0 |
Source: git+https://github.com/evanw/esbuild.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor