telexed ~ c / 2573455a-246radar:50 · agent_toolLIVE
← back
NO.
#2573455a
Topic
AGENTS & TOOLS
Source
MCP Servers
Published
2026-05-16 15:54:35
Importance
★ 5/10 — radar 50
`mcp_servers_official` patches Node dependency security alerts
FIG-2571:1

`mcp_servers_official` patches Node dependency security alerts

Several runtime and build-chain packages got patched without breaking changes. Worth mirroring if your MCP server or Node tool exposes static files, routing, or rate limits.

[ KEY POINTS ]
  1. @hono/node-server moved 1.19.9 -> 1.19.14, closing encoded-slash auth and serveStatic bypass paths.
  2. hono moved 4.11.7 -> 4.12.17; file access, cookie/SSE injection, and IP matching bugs make this a ship-now update.
  3. express-rate-limit 8.5.0 fixes IPv4-mapped IPv6 bypass, which matters for public APIs behind imperfect proxy config.
  4. path-to-regexp, minimatch, brace-expansion, ajv, and qs all include DoS/ReDoS fixes; audit transitive locks, not just direct deps.
  5. Remaining 7 moderate dev-only alerts sit in the vitest/vite/esbuild chain and need a major vitest 4.x bump.
Originalgithub.com/modelcontextprotocol/servers/commit/3f40d6e73180ff8e301d69fa97c0b545fe111a8eRead original →

// related