Insecure Default Initialization of Resource in typescript-sdk - CVE-2025-66414
Published: March 11, 2026
Vulnerability identifier: #VU123885
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2025-66414
CWE-ID: CWE-1188
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Model Context Protocol
Affected software:
typescript-sdk
typescript-sdk
Detailed vulnerability description
The vulnerability allows a remote attacker to read and modify data on the system.
The vulnerability exists due to Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. A remote attacker can invoke tools or access resources exposed by the MCP server on behalf of the user in limited circumstances.
How to mitigate CVE-2025-66414
Install updates from vendor's website.