@absmartly/mcp (>=1.1.0, <=1.2.4), @agishub/mcp (>=2.1.0, <=3.0.1) +115 more potentially affected by CVE-2026-1664 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =1.1.0, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =1.0.27 - @famma/mcp-auth 0.0.4 - @fastmcp-me/gologin-mcp 0.0.8 and more Source cves: CVE-2026-1664 Source advisory: GHSA-R7X9-8PH7-W8CG...

@absmartly/mcp (>=1.1.0, <=1.2.4), @agishub/mcp (>=2.1.0, <=3.0.1) +115 more potentially affected by CVE-2026-1664 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =1.1.0, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =1.0.27 - @famma/mcp-auth 0.0.4 - @fastmcp-me/gologin-mcp 0.0.8 and more Source cves: CVE-2026-1664 Source advisory: SNYK:JS-AGENTS-15209148...

@absmartly/mcp (>=1.1.0, <=1.2.4), @agishub/mcp (>=2.1.0, <=3.0.1) +115 more potentially affected by CVE-2026-1664 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =1.1.0, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =1.0.27 - @famma/mcp-auth 0.0.4 - @fastmcp-me/gologin-mcp 0.0.8 and more Source cves: CVE-2026-1664 Source advisory: OSV:GHSA-R7X9-8PH7-W8CG...

@absmartly/mcp (>=1.1.0, <=1.2.4), @agishub/mcp (>=2.1.0, <=3.0.1) +115 more potentially affected by CVE-2026-1664 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =1.1.0, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =1.0.27 - @famma/mcp-auth 0.0.4 - @fastmcp-me/gologin-mcp 0.0.8 and more Source cves: CVE-2026-1664 Source advisory: MEND:CVE-2026-1664...

CVE-2026-1664

Summary: CVE-2026-1664 affects Cloudflare Agents SDK prior to 0.3.7, due to an IDOR in header-based email routing. Root cause: createHeaderBasedEmailResolver() parses Message-ID and References to derive target agentName/agentId without cryptographic/origin verification, letting external headers s...