CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the…
Published Dec 2, 2025 · Updated Feb 17, 2026
Affected packages
@modelcontextprotocol/sdk
- Ecosystem
- npm
- Affected
- < 1.24.0
- Fixed in
- 1.24.0
- Check
npm ls @modelcontextprotocol/sdk
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.
Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.
Servers created via createMcpExpressApp() now have this protection enabled by default when binding to localhost. Users with custom Express configurations are advised to update to version 1.24.0 and apply the exported hostHeaderValidation() middleware when running an unauthenticated server on localhost.
Credited to JLLeitschuh.
References
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-w48q-cv73-mx4w
- https://github.com/modelcontextprotocol/typescript-sdk/pull/1205
- https://github.com/modelcontextprotocol/typescript-sdk/commit/608360047dc6899f1cf4f0226eb62fe7b11b3898
- https://nvd.nist.gov/vuln/detail/CVE-2025-66414
- https://github.com/modelcontextprotocol/typescript-sdk/commit/09623e2aa5044f9e9da62c73d820a8250b9d97ed
- https://github.com/advisories/GHSA-w48q-cv73-mx4w
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More MCP TypeScript SDK vulnerabilities
All MCP TypeScript SDK entriesCVE-2026-111767
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
high8.6Oct 20, 2026CVE-2026-111768
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
high7.5Oct 20, 2026CVE-2026-111769
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
medium6.5Oct 20, 2026CVE-2026-111771
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
medium6.8Oct 20, 2026CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
high7.5Oct 6, 2026CVE-2026-25536
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
high7.1Feb 4, 2026