CVE-2026-81100

tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...

EUVD-2026-67027

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81095 Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81095 Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81095

Timescale pg-aiguide (through 0.5.0 ) exposed a DNS-rebinding vulnerability in its MCP HTTP transport. The server at src/httpServer.ts called the httpServerFactory helper without setting the host allow-list (DNS-rebinding-protection) option provided by the underlying SDK, causing it to accept req...

CVE-2026-81095 Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

EUVD-2026-67023

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092

mcp-go before 0.56.0 accepted HTTP requests on its Streamable HTTP and SSE transports without validating the Host header . Specifically, StreamableHTTPServer.ServeHTTP (server/streamable_http.go) and SSEServer.ServeHTTP (server/sse.go) served any request arriving over a loopback connection regard...

EUVD-2026-67147

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-76172

A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers URIs in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An...

CVE-2026-75931

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...

CVE-2026-16732

A flaw was found in fastify. When configured with a numeric trustProxy value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for host injection in generated URLs, bypasses HTTPS enforcement, a...

Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...