# esbuild CORS misconfiguration allows source code theft

Source: https://junglewise.ai/threats/esbuild-cors-misconfiguration-allows-source-code-theft-3f1aa15a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-02-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2025-02-10

esbuild is a JavaScript bundler that developers use to build web applications during development. Its development server is enabled with overly permissive CORS headers that allow any website to fetch bundled JavaScript files and source maps from a developer's local machine, potentially exposing proprietary source code to malicious websites the developer visits.

Technologies: [esbuild (npm)](https://junglewise.ai/threats/technologies/esbuild). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 10 February 2025.

**Which products and versions are affected?** esbuild (npm) SEMVER:introduced=0,fixed=0.25.0.

**Is there a fix for This vulnerability?** Yes. esbuild (npm): upgrade to 0.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run esbuild (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- esbuild (npm): upgrade to 0.25.0 or later

  ```sh
  npm install esbuild@0.25.0
  ```


## Technical details

esbuild's development server sets the Access-Control-Allow-Origin header to "*" on all responses, including Server-Sent Events (SSE) endpoints, violating proper CORS origin validation (CWE-346). An attacker can host a malicious webpage that, when visited by a developer running esbuild's serve feature, uses JavaScript fetch() to retrieve bundled code and source maps from the local development server (typically http://127.0.0.1:8000/). The attacker can discover file names by querying /index.html, directory listings, or monitoring the /esbuild SSE endpoint. The attack requires user interaction (visiting a malicious site) but no authentication or special privileges. Versions up to and including 0.24.2 are affected; the fix is available in version 0.25.0.

## Affected products

- evanw esbuild <= 0.24.2

## Timeline

- 2025-02-10: disclosed: Advisory GHSA-67mh-4wv8-2f99 published
- 2025-02-07: patched: Fix committed; patched in version 0.25.0

## References

- [https://github.com/evanw/esbuild/security/advisories/GHSA-67mh-4wv8-2f99](https://github.com/evanw/esbuild/security/advisories/GHSA-67mh-4wv8-2f99)
- [https://github.com/evanw/esbuild/commit/de85afd65edec9ebc44a11e245fd9e9a2e99760d](https://github.com/evanw/esbuild/commit/de85afd65edec9ebc44a11e245fd9e9a2e99760d)

## Related threats

- [esbuild Deno module missing binary integrity verification in npm download](https://junglewise.ai/threats/esbuild-deno-module-missing-binary-integrity-verification-in-npm-995a886a)
- [esbuild path traversal in development server on Windows](https://junglewise.ai/threats/esbuild-path-traversal-in-development-server-on-windows-4c2fbe4a)