Fetch-MCP SSRF Vulnerability

HIGH (7.5)
cwe-918fetch-mcphttp-clientnpmssrf-vulnerability

Threat Intelligence

Low Risk
EPSS Score: 0.03% chance of exploitation (percentile: 9%)
🔍 Detection Tools: None available in major open-source tools
⚔️ Exploit Availability: No public exploits found

How we test →

What is it?

Fetch-mcp is a lightweight, open-source HTTP client library used to simplify HTTP requests. This vulnerability allows attackers to bypass private IP validation and access internal network resources by sending maliciously crafted requests.

Am I affected?

Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

How to fix

To fix this vulnerability, upgrade to fetch-mcp v1.0.3 or later. You can do this by running:

  • npm install fetch-mcp@latest
  • yarn add fetch-mcp@latest

Alternatively, you can apply immediate mitigations without upgrading immediately:

  • Set the fetch option to use a proxy server that restricts access to internal network resources.
  • Implement rate limiting on incoming requests.

References