CVE-2026-49857

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in "assertSafeUrl" "src/security.ts" to block requests to private and loopback addresses. However, the "isPrivateV6" function fails to detect IPv4-mapped IP...