Executive brief
The Model Context Protocol (MCP) TypeScript SDK is a development library for building AI assistant integrations. When running HTTP-based MCP servers locally without authentication, the SDK did not enable DNS rebinding protection by default, allowing a malicious website to bypass browser security restrictions and send unauthorized requests to the local server. An attacker could invoke tools or access sensitive resources exposed by the MCP server running on a user's machine.
Technical details
The vulnerability is a DNS rebinding bypass (CWE-1188, CWE-350) in the MCP TypeScript SDK's HTTP-based server transports (StreamableHTTPServerTransport and SSEServerTransport). When an unauthenticated HTTP server binds to localhost without explicit enableDnsRebindingProtection, an attacker can craft a malicious website that performs DNS rebinding to redirect legitimate-looking requests to the victim's local MCP server, bypassing same-origin policy (SOP) protections. The attack requires user interaction (visiting a malicious site) and specific deployment conditions (HTTP without auth on localhost). Version 1.24.0 and later enable DNS rebinding protection by default for createMcpExpressApp() and provide hostHeaderValidation() middleware for custom Express configurations. Stdio-based servers are unaffected.
Affected products
- Anthropic MCP TypeScript SDK < 1.24.0
Timeline
- 2025-12-02: disclosed
- 2025-12-02: patched: Version 1.24.0 released with DNS rebinding protection enabled by default