esbuild's built-in dev server, started with serve or --servedir, responded to cross-origin requests in a way that allowed any web page the developer visited to fetch the served source and bundle output. The issue was assigned an advisory and fixed in esbuild 0.25.0, which restricts the default and adds explicit CORS configuration.
The exposure is limited to machines running the dev server, but it includes application source, source maps, and anything else under the served directory, which frequently contains configuration and comments not intended to leave the machine. Vite, Nuxt, and other tools that embed esbuild inherited the issue until they upgraded.
Check the resolved version rather than the declared range, since esbuild is usually a transitive dependency: npm ls esbuild shows every copy in the tree. If a build tool pins an older esbuild, an overrides or resolutions entry forces the patched version. The dev server was never intended for exposure beyond localhost in any version.