DNS Rebinding Vulnerability in MCP TypeScript SDK

CVE-2025-66414

What is CVE-2025-66414?

The Model Context Protocol (MCP) TypeScript SDK prior to version 1.24.0 lacks DNS rebinding protection for HTTP-based servers by default. This vulnerability could allow malicious websites to exploit the local MCP server without authentication, potentially bypassing same-origin policy restrictions. Although using HTTP-based MCP servers locally without authentication is discouraged, this issue emphasizes the importance of enabling appropriate security measures, including DNS rebinding protection, to prevent unauthorized access or actions on behalf of the user.

References