@agishub/mcp (>=2.1.0, <=2.1.2), @anngdinh/remote-mcp-server-authless (0.0.0) +117 more potentially affected by CVE-2026-1664 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =0.2.0, =0.5.3 and more Source cves: CVE-2026-1664 Source advisory: OSV:GHSA-R7X9-8PH7-W8CG...

@agishub/mcp (>=2.1.0, <=2.1.2), @anngdinh/remote-mcp-server-authless (0.0.0) +117 more potentially affected by CVE-2026-1664 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =0.2.0, =0.5.3 and more Source cves: CVE-2026-1664 Source advisory: SNYK:JS-AGENTS-15209148...

CVE-2026-1664

Summary: CVE-2026-1664 affects Cloudflare Agents SDK prior to 0.3.7, due to an IDOR in header-based email routing. Root cause: createHeaderBasedEmailResolver() parses Message-ID and References to derive target agentName/agentId without cryptographic/origin verification, letting external headers s...