{"action":"Upgrade @utcp/http to 1.1.2 or later.","affected":[{"fixed":"1.1.2","introduced":"0"}],"component":"@utcp/http","cve_ids":["CVE-2026-45366"],"ecosystem":"npm","epss":0.00196,"exploited":false,"fixed_versions":["1.1.2"],"ghsa_id":"GHSA-r8j5-8747-88cm","id":"tcs_01M5KG8GQCV6PCCMBA2KF0AEMY","modified_at":"2026-09-10T03:50:47.363616586Z","published_at":"2026-05-14T20:55:05Z","references":["https://osv.dev/vulnerability/GHSA-r8j5-8747-88cm","https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm","https://nvd.nist.gov/vuln/detail/CVE-2026-45366","https://github.com/universal-tool-calling-protocol/python-utcp/issues/83","https://github.com/universal-tool-calling-protocol/typescript-utcp"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-r8j5-8747-88cm","url":"https://osv.dev/vulnerability/GHSA-r8j5-8747-88cm"}],"summary":"@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol"}