High, CVSS 7.5npmAmendedPublished
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
CVE-2026-42559 · GHSA-fvh2-gm75-j4j7
- Affected
- npm dynoxide >= 0.9.3, < 0.9.13
- Fixed in
- 0.9.13· Vendor fix available
- Issue
- dynoxide's MCP HTTP transport was vulnerable to DNS rebinding via its transitive rmcp dependency, plus a related cross-origin CSRF gap. A malicious web page could make the user's browser send requests to a local dynoxide mcp --http or dynoxide serve --mcp server with a non-loopback Host header, which the server would then process. Affects 0.9.3 to 0.9.12. The stdio transport (dynoxide mcp without --http, which is the default) is not affected. Impact If a user is running dynoxide mcp --http (or dynoxide serve --mcp) on their machine and then visits a malicious web page, the attacker's JavaScript can call any MCP tool exposed by the running dynoxide instance. Reachable tools include reads (getitem, query, scan, batchgetitem, describetable, listtables) and writes (putitem, updateitem, deleteitem, createtable, batchwriteitem). Any data in tables that the local dynoxide instance has access to can be read, modified, or destroyed. Patches dynoxide 0.9.13 closes both the named CVE…
Recommended action: Upgrade to 0.9.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.