java-topology/whitepaper/outreach/esbuild.md

esbuild — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(H) linear-scan defect in esbuild's dev server host validation. Patched. Patch ready for upstream review. Fires on every HTTP request.

The Defects

esbuild-0001 (PATCHED — MEDIUM): pkg/api/serve_other.go:139

// In ServeHTTP() — fires on every HTTP request:
for _, allowed := range h.hosts {
    if req.Host == allowed {
        ok = true
        break
    }
}

h.hosts is a []string slice. Every incoming HTTP request performs an O(H) linear scan to validate the Host header against the allowed hosts list.

Complexity Proof

At H=100 allowed hosts:

• Defective: up to 100 comparisons per HTTP request
• Fixed: 1 lookup per request (map)
• 100x op reduction per request.

Impact

esbuild is the dominant JavaScript bundler, used by millions of developers. The dev server processes many requests per second during development (HMR, asset loading, source maps). While the allowed hosts list is typically small, the fix also eliminates DNS rebinding attack surface by using a constant-time check.

The Fix

Replace []string with map[string]struct{}:

// Before
hosts: append([]string{}, result.Hosts...)
for _, allowed := range h.hosts { if req.Host == allowed { ok = true; break } }

// After
hosts: func() map[string]struct{} {
    m := make(map[string]struct{}, len(result.Hosts))
    for _, h := range result.Hosts { m[h] = struct{}{} }
    return m
}()
_, ok := h.hosts[req.Host]

Patch

Fix available: defects/esbuild/patch/esbuild-0001-serve-hosts-map.patch

Single-file patch on pkg/api/serve_other.go. 100x speedup at H=100 allowed hosts.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (evanw/esbuild).
2. Assess severity — fires on every HTTP request to the dev server.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the esbuild team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.