esbuild

0.28.2 · 8 Aug 2026MIT184.3M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Line	Newest	Where it stands
	0.28.2	Safe from 0.28.1
	0.27.7	1 open advisory, worst low
	0.26.0	No known advisory
	0.25.12	No known advisory
	0.24.2	25 open advisories, worst moderate · last release Dec 2024, no longer updated

Your version

Moderate
esbuild enables any website to send any requests to the development server and read the responseGHSA-67mh-4wv8-2f99 · 10 Feb 2025
- 0.24.x and older0.0.0 – 0.24.2No fix, no longer updated
Low
esbuild allows arbitrary file read when running the development server on WindowsGHSA-g7r4-m6w7-qqqr · 12 Jun 2026
- 0.28.x0.28.0Fixed in 0.28.1
- 0.27.x0.27.3 – 0.27.7No fix on 0.27.x · move to 0.28.1

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.