GitHub Advisoryadvisory · npm

GHSA-8fxj-2g9q-8fjw Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

MEDIUM Published 2025-12-10 Modified 2025-12-10 Official page ↗
Aliases
CVE-2025-65513
Ecosystem
npm
Packages
mcp-fetch-server
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-918
Reviewed
2025-12-10

Affected packages

• npm mcp-fetch-server: <= 1.0.2 (no fix yet)

Description

fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and access internal network resources.

Related

Alias · CVE (1)

  • CVE-2025-65513 fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References