Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 12 June 2026.

Which products and versions are affected?

esbuild (npm) SEMVER:introduced=0.17.0,fixed=0.28.1.

Is there a fix for This vulnerability?

Yes. esbuild (npm): upgrade to 0.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run esbuild (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

esbuild Deno module missing binary integrity verification in npm download

Severity: low · CVSS 3.1 · Published 2026-06-12

esbuild is a JavaScript bundler with Deno module support that downloads native binaries from npm registries during installation. A missing integrity check in the Deno variant allows attackers who control the NPM_CONFIG_REGISTRY environment variable to supply malicious binaries that execute with the privileges of the Deno process, achieving complete code execution. This is particularly dangerous in CI/CD pipelines and shared development environments where registry configuration is often centralized.

Technologies: esbuild (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 12 June 2026.
Which products and versions are affected?: esbuild (npm) SEMVER:introduced=0.17.0,fixed=0.28.1.
Is there a fix for This vulnerability?: Yes. esbuild (npm): upgrade to 0.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run esbuild (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

esbuild (npm): upgrade to 0.28.1 or later
```
npm install esbuild@0.28.1
```

Technical details

The esbuild Deno module (lib/deno/mod.ts) fetches native binary executables from an npm registry specified by the NPM_CONFIG_REGISTRY environment variable without performing SHA-256 integrity verification. The Node.js equivalent (lib/npm/node-install.ts) includes a binaryIntegrityCheck() function that validates downloaded binaries against hardcoded hashes in package.json, but this protection was never implemented for Deno. An attacker controlling the NPM_CONFIG_REGISTRY variable can redirect downloads to a malicious server and serve trojaned binaries that are written to disk with executable permissions (0o755) and subsequently executed by the Deno process. The vulnerability affects versions >=0.17.0 and was patched in >=0.28.1. No user interaction or prior authentication is required; the attack vector is network-accessible and depends only on environment variable manipulation, which is common in enterprise CI/CD systems.

Affected products

evanw esbuild >=0.17.0

Timeline

2026-06-11: disclosed
2026-06-28: patched: Fixed in version 0.28.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.