Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 12 June 2026.

Which products and versions are affected?

esbuild (npm) SEMVER:introduced=0.27.3,fixed=0.28.1.

Is there a fix for This vulnerability?

Yes. esbuild (npm): upgrade to 0.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run esbuild (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

esbuild path traversal in development server on Windows

Severity: low · CVSS 3.1 · Published 2026-06-12

esbuild is a popular JavaScript bundler that includes a development server. On Windows systems, the development server incorrectly validates file paths, allowing an attacker to read arbitrary files on the system by crafting specially-formatted requests with backslash characters. An attacker with local access who can make requests to the development server can read sensitive system files or configuration data.

Technologies: esbuild (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 12 June 2026.
Which products and versions are affected?: esbuild (npm) SEMVER:introduced=0.27.3,fixed=0.28.1.
Is there a fix for This vulnerability?: Yes. esbuild (npm): upgrade to 0.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run esbuild (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

esbuild (npm): upgrade to 0.28.1 or later
```
npm install esbuild@0.28.1
```

Technical details

The vulnerability is a path traversal (CWE-22) in the development server's file serving logic on Windows. The root cause is improper path normalization: the code uses Go's path.Clean() function, which is POSIX-aware and only normalizes forward slashes (/), but Windows filesystems also recognize backslashes (\) as directory separators. An attacker can craft HTTP requests containing sequences like ..\..\..\ to escape the configured servedir root directory and access arbitrary files. The vulnerability requires local network access to the development server (attack vector: local) and low privileges (the attacker must be able to send HTTP requests), but no user interaction. The impact is confidentiality loss through arbitrary file read. The vulnerability was introduced in version 0.27.3 and patched in version 0.28.1.

Affected products

evanw esbuild 0.27.3

Timeline

2026-06-11: disclosed
2026-06-12: patched: Fixed in version 0.28.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.