Security vulnerabilities and automated fixes for dns rebinding issues
2 posts found
The `@modelcontextprotocol/sdk` package (version 0.5.0) shipped without DNS rebinding protection enabled by default, leaving any Node.js application that hosts an MCP server exposed to cross-origin attacks from malicious websites. Upgrading to version 1.24.0 enables host-header validation and brings a suite of new security dependencies—including `cors`, `express-rate-limit`, and `jose`—that collectively close the attack surface. This fix was identified and patched automatically by Orbis AppSec b
The Model Context Protocol (MCP) TypeScript SDK in version 1.17.1 lacked DNS rebinding protection, leaving applications vulnerable to a sophisticated network-level attack. By upgrading to version 1.24.0, DNS rebinding protection is now enabled by default, preventing attackers from exploiting the SDK's HTTP request handling to access internal resources or bypass security controls.