Read the docs
TI-2025-40850 Aliases CVE-2025-66414GHSA-w48q-cv73-mx4w

DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

Priority LOW 36CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.24.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00544 45th percentileScored 2026-11-07
Fix Fixed typescript-sdk (modelcontextprotocol): 1.24.0@modelcontextprotocol/sdk (npm): 1.24.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowtypescript-sdkbefore 1.24.01.24.0Patch availableCNA
—@modelcontextprotocol/sdk (npm)before 1.24.01.24.0Patch availableGHSA-w48q-cv73-mx4w
  • typescript-sdk VendorMLflow Affected before 1.24.0 Fixed in 1.24.0 Patch available CNA
  • @modelcontextprotocol/sdk (npm) Vendor— Affected before 1.24.0 Fixed in 1.24.0 Patch available GHSA-w48q-cv73-mx4w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mcp_typescript_sdk:*:*:*:*:*:*:*:*before 1.24.0VulnerableMLflow
  • cpe:2.3:a:lfprojects:mcp_typescript_sdk:*:*:*:*:*:*:*:* Versions before 1.24.0 Vulnerable ·MLflow

Remediation

  • Fix · CNA typescript-sdk (modelcontextprotocol) Fixed in 1.24.0
  • Fix · GHSA-w48q-cv73-mx4w @modelcontextprotocol/sdk (npm) Fixed in 1.24.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66414
  2. 2026-10-03 Alias added: GHSA-w48q-cv73-mx4w

References

Patch 1

Advisory 2

Other 3

  • TI-2026-00421 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS CVSS 4.0HIGH 8.7
  • TI-2026-20645 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences