Skip to content

chore(deps): update dependency @modelcontextprotocol/sdk to v1.24.0 [security]#135

Open
descope[bot] wants to merge 4 commits intomainfrom
renovate/npm-modelcontextprotocol-sdk-vulnerability
Open

chore(deps): update dependency @modelcontextprotocol/sdk to v1.24.0 [security]#135
descope[bot] wants to merge 4 commits intomainfrom
renovate/npm-modelcontextprotocol-sdk-vulnerability

Conversation

@descope
Copy link
Contributor

@descope descope bot commented Dec 2, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change OpenSSF
@modelcontextprotocol/sdk (source) dependencies minor 1.15.1 -> 1.24.0 OpenSSF Scorecard

GitHub Vulnerability Alerts

CVE-2025-66414

The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.

Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.

Servers created via createMcpExpressApp() now have this protection enabled by default when binding to localhost. Users with custom Express configurations are advised to update to version 1.24.0 and apply the exported hostHeaderValidation() middleware when running an unauthenticated server on localhost.

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

CVE-2025-66414 / GHSA-w48q-cv73-mx4w

More information

Details

The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.

Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.

Servers created via createMcpExpressApp() now have this protection enabled by default when binding to localhost. Users with custom Express configurations are advised to update to version 1.24.0 and apply the exported hostHeaderValidation() middleware when running an unauthenticated server on localhost.

Severity

  • CVSS Score: 7.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.24.0

Compare Source

Summary

This release brings us up to speed with the latest MCP spec 2025-11-25. Take a look at the latest spec as well as the release blog post.

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.23.0...1.24.0

v1.23.1

Compare Source

Fixed:

  • Disabled SSE priming events to fix backwards compatibility - 1.23.x clients crash on empty SSE data (JSON.parse(""))

This is a patch for servers still on 1.23.x that were breaking clients not handling the the 2025-11-25 priming event behavior with empty SSE data fields. See #​1233 for more details.

Full Changelog: modelcontextprotocol/typescript-sdk@1.23.0...1.23.1

v1.23.0

Compare Source

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.22.0...1.23.0

v1.22.0

Compare Source

What's Changed

@descope descope bot added the security label Dec 2, 2025
@descope descope bot enabled auto-merge (squash) December 2, 2025 17:48
@descope descope bot assigned dorsha and omercnet Dec 2, 2025
@descope descope bot force-pushed the renovate/npm-modelcontextprotocol-sdk-vulnerability branch from 89dc3e3 to b602f9e Compare December 3, 2025 14:43
@descope descope bot force-pushed the renovate/npm-modelcontextprotocol-sdk-vulnerability branch from b602f9e to fc01943 Compare December 4, 2025 23:32
descope-approve[bot]
descope-approve bot previously approved these changes Dec 4, 2025
View reviewed changes
@descope
Copy link
Contributor Author

descope bot commented Dec 5, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@omercnet
Copy link
Member

omercnet commented Jan 10, 2026

@shuni fix it

@shuni-bot
Copy link

shuni-bot bot commented Jan 10, 2026 •
edited
Loading

🐕 Done! Updated PR: #135

View workflow run

📋 Actions Taken

View AI response

Perfect! Let me create a summary of what was done:

Summary

I've successfully fixed the security vulnerability by updating the @modelcontextprotocol/sdk dependency from version 1.15.1 to 1.24.0. Here's what was done:

Changes Made

  1. Updated package.json: Changed @modelcontextprotocol/sdk from ^1.15.1 to ^1.24.0
  2. Updated pnpm-lock.yaml: Ran pnpm install --no-frozen-lockfile to update the lockfile with the new dependency version and all its transitive dependencies

Security Fix Details

The update addresses CVE-2025-66414 (CVSS Score: 7.6 / 10 - High severity):

  • Issue: DNS rebinding vulnerability in HTTP-based MCP servers
  • Impact: When an HTTP-based MCP server runs on localhost without authentication, a malicious website could exploit DNS rebinding to bypass same-origin policy and access local MCP server resources
  • Fix: Version 1.24.0 enables DNS rebinding protection by default when binding to localhost in createMcpExpressApp() and provides hostHeaderValidation() middleware for custom Express configurations

Build Status

✅ Build: Successful - Project compiles without errors
✅ Tests: 54 out of 55 tests pass (1 pre-existing test failure unrelated to SDK update)
✅ Dependencies: All dependencies installed and compatible

Notes

  • The failing test (should throw error when projectId is missing) is a pre-existing issue in the test suite where an environment variable (DESCOPE_PROJECT_ID) interferes with the test. This is unrelated to the SDK update.
  • Some linting and formatting issues in src/utils.ts are from a previous "fix" commit and are not related to this security update.
  • The codebase doesn't use createMcpExpressApp(), but still benefits from the security patches included in the SDK update.

The security vulnerability has been resolved, and the codebase is ready for the CI pipeline to handle the git operations.

@omercnet
Copy link
Member

omercnet commented Jan 10, 2026

@shuni fix lint

@shuni-bot
Copy link

shuni-bot bot commented Jan 10, 2026 •
edited
Loading

🐕 Uh oh! I ran into an error.

View failed run

Please check the logs for details.

@omercnet
Copy link
Member

omercnet commented Jan 10, 2026

@shuni fix lint

@shuni-bot
Copy link

shuni-bot bot commented Jan 10, 2026 •
edited
Loading

🐕 Uh oh! I ran into an error.

View failed run

Please check the logs for details.

@omercnet
Copy link
Member

omercnet commented Jan 10, 2026

@shuni fix lint

@shuni-bot
Copy link

shuni-bot bot commented Jan 10, 2026 •
edited
Loading

🐕 Uh oh! I ran into an error.

View failed run

Please check the logs for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@descope-approve descope-approve[bot] descope-approve[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@omercnet omercnet

@dorsha dorsha

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@omercnet @dorsha