GHSA-8fxj-2g9q-8fjw

Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-65513

Packages

Ecosystem	Package	Affected	Fixed in
npm	mcp-fetch-server	<= 1.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and access internal network resources.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-65513 advisory
https://github.com/Team-Off-course/MCP-Server-Vuln-Analysis/blob/main/CVE-2025-65513.md web
https://github.com/zcaceres/fetch-mcp package
https://github.com/zcaceres/fetch-mcp/blob/c662c8ac300f715e414a64766cd95cc9ec60a1b3/src/Fetcher.ts#L20 web
https://thorn-pheasant-6d8.notion.site/fetch-mcp-2853daf7b44180029ca5d56e03195736 web