shouldiuse.io

VERDICT

Should I use ESM>CDN (esm.sh)?

A fast, smart & global CDN for modern(es2015+) web development. - esm.sh

Depends. Free and excellent for prototypes, demos, and Deno projects — import any npm package by URL with no build step. Do not make a third-party CDN a production runtime dependency if you need SLAs, supply-chain control, or security compliance.

Confidence

Medium. Based on 20+ public sources; developer-tool coverage, no enterprise or paid-tier reviews found.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence found
  • Security posture

Pricing

Not disclosed

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Zero-build prototypes and demos
  • Deno projects importing npm packages
  • Static sites wanting React without a bundler
  • Self-hosters bringing their own cache

Not for

  • Production apps needing uptime SLAs or guarantees
  • Orgs with strict supply-chain and security reviews
  • Anyone wanting paid support contracts — none documented
  • Air-gapped or offline environments

Gotchas - check before you buy

high

Runtime dependency: outages or CVEs hit your users directly, not your repo

high

v136 had a full-response SSRF; pin versions and watch advisories

medium

No SLAs, pricing tiers, or paid support documented — community/GitHub only

low

Self-hosting exists but shifts all operational and cache burden onto you

Pros and cons

Pros

  • Free, open-source CDN; self-hosting possible
  • 10.5B+ modules served in last 30 days
  • Zero-build: import npm packages by URL
  • Deno-friendly; resolves Node built-in modules
  • Used by Fresh framework and Deno projects

Cons

  • Two 2025 CVEs: path traversal and SSRF
  • No public security page
  • Package-resolution bugs reported (wrong @reduxjs/toolkit entry)
  • Guess: runtime dependency on a third-party CDN adds availability risk

Sources & method

Analyzed 9/21/2026 - 14 sources - Two 2025 CVEs (path traversal pre-v136, full-response SSRF in v136); no security page.

official x3review x5security x4news x2
  • CVE-2025-65025 — path traversal during NPM package handling, Prior to version 136, the CDN service is vulnerable to path traversal during NPM package resolution.
  • CVE-2025-50180 — full-response SSRF, In version 136, is vulnerable to a full-response SSRF, allowing an attacker to retrieve internal resources; affects v136 deployments.

Key stats

  • Value for money: 5/5

    Rating

  • Not disclosed

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 5/5. Free, open source, no paid tiers found
  • Ease of use: 4/5. Import npm packages by URL, zero build
  • Feature depth: 4/5. Resolves Node built-ins; custom CDN templates
  • Support quality. No support evidence found
  • Security posture: 2/5. Two 2025 CVEs; no security page
  • Free Price Open source; self-host option exists
  • 10.5B+ Modules served Last 30 days, per site counter
  • 1,965 Third-party sites tracked 755 ms median load time
  • 2 Known CVEs (2025) Path traversal + full-response SSRF

Pricing

Free tier: Yes

Security

Two 2025 CVEs (path traversal pre-v136, full-response SSRF in v136); no security page.

  • CVE-2025-65025 — path traversal during NPM package handlingPrior to version 136, the CDN service is vulnerable to path traversal during NPM package resolution.⁷
  • CVE-2025-50180 — full-response SSRFIn version 136, is vulnerable to a full-response SSRF, allowing an attacker to retrieve internal resources; affects v136 deployments.⁹

What users say

Developers — especially in the Deno community — like the zero-build npm-by-URL workflow but report occasional package-resolution bugs.

Alternatives

Compare ESM>CDN (esm.sh) with each alternative.

  • npm install + bundler (Vite)

    Full control, no third-party runtime dependency.

Companies that use it

  • Spectral (Stoplight)13
Full analysis

Based on 20+ public sources; developer-tool coverage, no enterprise or paid-tier reviews found.

Free zero-build ESM CDN — ideal for prototypes and Deno; risky as a production runtime dependency.

Methodology

Based on 20+ public sources; developer-tool coverage, no enterprise or paid-tier reviews found.

Sources

  1. ESM>CDN — official siteesm.sh
    official
  2. esm-dev/esm.sh on GitHubgithub.com
    official
  3. Going back to basics with Zero-Build Reactdev.to
    review
  4. Running React 19 From a CDN using esm.sh — Peter Kellnerpeterkellner.net
    review
  5. esm.sh ESM CDN v55 release — r/Denoreddit.com
    review
  6. esm.sh importing wrong @reduxjs/toolkit entry — r/Denoreddit.com
    review
  7. CVE-2025-65025 — path traversalx.com
    security
  8. CVE-2025-50180 — full-response SSRFx.com
    security
  9. SSRF in esm.sh CDN Response Handlingcodeant.ai
    security
  10. esm.sh security pageesm.sh
    security
  11. third-party-web tracked sites datanpmjs.com
    news
  12. esm.run by jsDelivrjsdelivr.com
    official
  13. Stoplight Spectral releases — esm cdn migrationgithub.com
    review
  14. Fresh framework / Deno firewall issuegithub.com
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.