CVE-2025-66414
1 advisory.
npm/@modelcontextprotocol/sdk CVE-2025-66414: high
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Action: Upgrade @modelcontextprotocol/sdk to 1.24.0 or later.
npm i @modelcontextprotocol/sdk@1.24.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.24.0 | - |
Fixed versions
| 1.24.0 |
Sources
- osv: GHSA-w48q-cv73-mx4w
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-w48q-cv73-mx4w
- https://nvd.nist.gov/vuln/detail/CVE-2025-66414
- https://github.com/modelcontextprotocol/typescript-sdk/pull/1205
- https://github.com/modelcontextprotocol/typescript-sdk/commit/09623e2aa5044f9e9da62c73d820a8250b9d97ed
- https://github.com/modelcontextprotocol/typescript-sdk/commit/608360047dc6899f1cf4f0226eb62fe7b11b3898
- https://github.com/modelcontextprotocol/typescript-sdk
CVE-2025-66414 · published · modified · JSON