EUVD-2026-125435

@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a host placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE...