VDB

CVE-2025-66414

CVE-2025-66414 PUBLISHED CVSS 7.599999904632568 HIGH

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

EPSS 0.54% · 45.6th percentile

Risk Scores

CVSS 4.0
7.599999904632568
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.54%
45.6th percentile

Affected Products

VendorProductVersions
lfprojectsmcp_typescript_sdk0
modelcontextprotocolsdk0
modelcontextprotocoltypescript-sdk0

Timeline

  • Dec 2, 2025 CVE Published
  • Dec 3, 2025 EPSS Score
  • Dec 8, 2025 EPSS Score
  • Dec 14, 2025 EPSS Score
  • Dec 19, 2025 EPSS Score
  • Dec 25, 2025 EPSS Score
  • Dec 30, 2025 EPSS Score
  • Jan 4, 2026 EPSS Score
  • Jan 10, 2026 EPSS Score
  • Jan 15, 2026 EPSS Score
  • Jan 21, 2026 EPSS Score
  • Jan 26, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›