CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

What it is

The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.

Servers created via createMcpExpressApp() now have this protection enabled by default when binding to localhost. Users with custom Express configurations are advised to update to version 1.24.0 and apply the exported hostHeaderValidation() middleware when running an unauthenticated server on localhost.

How to check

1. Affected: @modelcontextprotocol/sdk (npm) < 1.24.0.
2. Compare your installed version with the range above (command below).

How to fix

1. Upgrade @modelcontextprotocol/sdk to 1.24.0 or later.

npm ls @modelcontextprotocol/sdk

Sources

• GitHub Security Advisory GHSA-w48q-cv73-mx4w ↗
• NVD: CVE-2025-66414 ↗