EUVD-2026-97634

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109332

The Network-AI (npm network-ai) package versions before 5.15.2 is vulnerable to a CORS Origin Validation Error within the McpSseServer._handleRequest function in lib/mcp-transport-sse.ts. The root cause is the reflection of localhost Origins into the Access-Control-Allow-Origin header regardless ...