All vulnerabilities

CVE-2026-NONE · GHSA-hhq4-w9j2-38hg

mcp-web-validator: SSRF guard (assertPublicHttpUrl) is bypassable via DNS rebinding, defeating the documented private-address block

lowCWE-918

Vendor

AKzar1el

Package

mcp-web-validator npm

Affected

<= 1.0.0

Disclosed

2026-08

Credit

Avishai Gonen

ssrfdns-rebindingtoctoumcp

Published advisory