diff --git a/doc/api/errors.md b/doc/api/errors.md
index 88d982fd195394..c5041c796be011 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -1957,6 +1957,11 @@ An attempt was made to load a module with an unknown or unsupported format.
 An invalid or unknown process signal was passed to an API expecting a valid
 signal (such as [`subprocess.kill()`][]).
 
+<a id="ERR_UNSUPPORTED_ESM_URL_SCHEME"></a>
+### `ERR_UNSUPPORTED_ESM_URL_SCHEME`
+
+`import` with URL schemes other than `file` and `data` is unsupported.
+
 <a id="ERR_V8BREAKITERATOR"></a>
 ### `ERR_V8BREAKITERATOR`
 
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index a0f3f26d5d34be..a0b7ee38cf1963 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1335,6 +1335,8 @@ E('ERR_UNKNOWN_FILE_EXTENSION',
   TypeError);
 E('ERR_UNKNOWN_MODULE_FORMAT', 'Unknown module format: %s', RangeError);
 E('ERR_UNKNOWN_SIGNAL', 'Unknown signal: %s', TypeError);
+E('ERR_UNSUPPORTED_ESM_URL_SCHEME', 'Only file and data URLs are supported ' +
+  'by the default ESM loader', Error);
 
 E('ERR_V8BREAKITERATOR',
   'Full ICU data not installed. See https://github.com/nodejs/node/wiki/Intl',
diff --git a/lib/internal/modules/esm/default_resolve.js b/lib/internal/modules/esm/default_resolve.js
index 86e682d28e329f..749f6861cd3ee6 100644
--- a/lib/internal/modules/esm/default_resolve.js
+++ b/lib/internal/modules/esm/default_resolve.js
@@ -21,7 +21,8 @@ const { resolve: moduleWrapResolve,
         getPackageType } = internalBinding('module_wrap');
 const { URL, pathToFileURL, fileURLToPath } = require('internal/url');
 const { ERR_INPUT_TYPE_NOT_ALLOWED,
-        ERR_UNKNOWN_FILE_EXTENSION } = require('internal/errors').codes;
+        ERR_UNKNOWN_FILE_EXTENSION,
+        ERR_UNSUPPORTED_ESM_URL_SCHEME } = require('internal/errors').codes;
 
 const realpathCache = new SafeMap();
 
@@ -52,8 +53,9 @@ if (experimentalJsonModules)
   extensionFormatMap['.json'] = legacyExtensionFormatMap['.json'] = 'json';
 
 function resolve(specifier, parentURL) {
+  let parsed;
   try {
-    const parsed = new URL(specifier);
+    parsed = new URL(specifier);
     if (parsed.protocol === 'data:') {
       const [ , mime ] = /^([^/]+\/[^;,]+)(?:[^,]*?)(;base64)?,/.exec(parsed.pathname) || [ null, null, null ];
       const format = ({
@@ -68,6 +70,8 @@ function resolve(specifier, parentURL) {
       };
     }
   } catch {}
+  if (parsed && parsed.protocol !== 'file:' && parsed.protocol !== 'data:')
+    throw new ERR_UNSUPPORTED_ESM_URL_SCHEME();
   if (NativeModule.canBeRequiredByUsers(specifier)) {
     return {
       url: specifier,
diff --git a/test/es-module/test-esm-dynamic-import.js b/test/es-module/test-esm-dynamic-import.js
index 1fc22f1d98934a..e60309fe886cf9 100644
--- a/test/es-module/test-esm-dynamic-import.js
+++ b/test/es-module/test-esm-dynamic-import.js
@@ -15,8 +15,8 @@ function expectErrorProperty(result, propertyKey, value) {
     }));
 }
 
-function expectMissingModuleError(result) {
-  expectErrorProperty(result, 'code', 'ERR_MODULE_NOT_FOUND');
+function expectModuleError(result, err) {
+  expectErrorProperty(result, 'code', err);
 }
 
 function expectOkNamespace(result) {
@@ -56,10 +56,10 @@ function expectFsNamespace(result) {
   expectFsNamespace(eval('import("fs")'));
   expectFsNamespace(eval('import("fs")'));
 
-  expectMissingModuleError(import('./not-an-existing-module.mjs'));
-  // TODO(jkrems): Right now this doesn't hit a protocol error because the
-  // module resolution step already rejects it. These arguably should be
-  // protocol errors.
-  expectMissingModuleError(import('node:fs'));
-  expectMissingModuleError(import('http://example.com/foo.js'));
+  expectModuleError(import('./not-an-existing-module.mjs'),
+                    'ERR_MODULE_NOT_FOUND');
+  expectModuleError(import('node:fs'),
+                    'ERR_UNSUPPORTED_ESM_URL_SCHEME');
+  expectModuleError(import('http://example.com/foo.js'),
+                    'ERR_UNSUPPORTED_ESM_URL_SCHEME');
 })();