VulnSocial

CVE-2025-66414Patch(lfprojects / mcp_typescript_sdk)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch lfprojects mcp_typescript_sdk systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.24.0.

lfprojects CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-1188

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mcp_typescript_sdk

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Peaked 1d ago at 1 mentions (2026-06-01); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
lfprojects
Products
mcp_typescript_sdk

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-01: 1Mentions · 2026-06-06: 1Patch / Workaround · 2026-06-01: 1Patch / Workaround · 2026-06-06: 106-0106-06
Signal classification1 categories
Patch
2100.0%
Full discourse2 posts
  • 超级好吃的橘子@avinashlam30
    Patch

    🔒 Mem0 Node CLI v0.2.8 一次性修复 10+ 高危 CVE，包括 MCP SDK (CVE-2025-66414)、jws、tar-fs、path-to-regexp 等。这是近期 agent 生态最大规模安全补丁，建议立即升级。

    Post summary

    Mem0 Node CLI v0.2.8 releases a large‑scale patch for over ten high‑risk CVEs, including CVE-2025-66414, and urges users to upgrade immediately.

    1000092
    900 followersView on X
  • MX3 Dev@Mx3Dev
    Patch

    @mem0ai Dependency hardening → Pinned jws to 4.0.1 (CVE-2025-65945) → Pinned tar-fs to ^2.1.4 (CVE-2025-48387, CVE-2025-59343) → Pinned @modelcontextprotocol/sdk to ^1.25.4 (CVE-2025-66414, CVE-2026-0621) → Pinned rollup to ^4.59.0 (CVE-2026-27606)

    Post summary

    The tweet announces a dependency hardening effort by pinning secure versions to mitigate several CVEs, effectively providing a patch update.

    1000054
    106 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applfprojectsmcp_typescript_sdk---

Explore more

Back to dashboardlfprojects CVEsmcp_typescript_sdk vulnerabilities