CVE-2026-49857

npm/auth-fetch-mcp CVE-2026-49857: high 7.4

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

Action: Upgrade auth-fetch-mcp to 3.0.2 or later.

npm i auth-fetch-mcp@3.0.2

Affected

Fixed versions

Sources

• osv: GHSA-pvrj-8cg3-j5f8
• https://github.com/ymw0407/auth-fetch-mcp/security/advisories/GHSA-pvrj-8cg3-j5f8
• https://github.com/ymw0407/auth-fetch-mcp

CVE-2026-49857 · published 2026-07-01T18:16:22Z · modified 2026-07-01T18:41:31.529770Z · JSON