iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do not treat a clean dependency-scan result as proof that mcp-remote versions 0.1.16–0.1.38 are safe. Five OSV records published September 24, 2026 cover overlapping ranges in that span, and their Git-repository package metadata may not match the way a scanner recognizes npm dependencies. That is a reason to verify your scanner’s advisory feed and matching behavior—not proof that every scanner misses the records.
First, find out whether you are running an affected version
Check the version actually resolved or executed, not just the version range in package.json. A manifest can allow several versions; the lockfile or runtime cache is the better evidence of what was installed. Also search MCP client configuration, since mcp-remote may be invoked there rather than declared as a direct project dependency.
- Search configuration and project files. Look for
mcp-remotein MCP client configuration and repository files. If you use ripgrep, for example:rg -n --hidden --glob '!node_modules' 'mcp-remote' .. Review any command or package reference you find. - Check the resolved dependency. Inspect the relevant lockfile for the resolved
mcp-remoteversion. In an npm project,npm ls mcp-remotecan help show the installed dependency tree, but it does not establish what a separate npx invocation or another client’s runtime cache will execute. - Check the npx cache if applicable. If a client launches the package through npx, inspect the cache used by that client and identify the version there. Cache locations and client behavior can vary, so verify the actual invocation rather than assuming the project lockfile covers it.
- Compare that exact version with each record below. A version can be outside one record’s range but still fall within another’s.
Which CVEs cover which versions?
OSV’s records were published September 24, 2026, and modified September 26, 2026. The ranges below are the affected versions stated in those records; endpoints are inclusive. The package entries use Git-repository metadata rather than a conventional npm semver range.
| Record | Affected mcp-remote versions | Issue described by OSV | OSV-reported CVSS |
|---|---|---|---|
| CVE-2026-51994 | 0.1.32–0.1.38 | SSRF via the resource_metadata URL in a remote MCP server’s WWW-Authenticate header |
9.1 |
| CVE-2026-51995 | 0.1.32–0.1.38 | Sensitive-information exposure involving authorization-server-metadata.ts and utils.ts |
7.5 |
| CVE-2026-51996 | 0.1.16–0.1.38 | Arbitrary code execution involving getServerUrlHash |
Not stated in the reviewed OSV record |
| CVE-2026-51997 | 0.1.16–0.1.38 | Arbitrary code execution involving open() functions |
8.8 |
| CVE-2026-52001 | 0.1.18–0.1.38 | Sensitive-information exposure involving the SSE transport eventSourceInit fetch wrapper |
Not stated in the reviewed OSV record |
The scores are the values OSV reports for those individual records; they are not independent severity assessments. Do not infer a score for the two records marked “not stated.”
#1 Best Overall
Why a scanner might not show these records
OSV describes the five affected packages using Git-repository metadata. That differs from the npm package and semver representation used in the separate GitHub-reviewed advisory for CVE-2025-6514. A scanner that relies on npm ecosystem advisories or matches package identities in a particular way may therefore fail to associate the newer records with an npm dependency. This is a metadata-based possibility, not a validated result for any named scanner.
To check your own tool, search its current advisory feed or vulnerability details for all five CVE IDs, and confirm how it maps the repository identity in each OSV entry to the npm package installed in your project. Check whether the advisory feed is current as well as whether the scanner reports a match. A “no vulnerabilities found” result answers only what that tool recognized under its present data and matching rules.
What to do if your resolved version is in range
The five OSV records list the same fixing commit: 02619aff36e79803d7c894e8c8ae7b34b2d11f8c. The evidence available here does not establish which published npm release contains that commit. Do not assume that a particular version is fixed based only on the commit reference.
- Check upstream release notes or other authoritative project information to confirm which published release includes the fixing commit.
- Upgrade to a confirmed fixed release, then verify the resolved version in the lockfile or runtime cache and rerun the scanner.
- Until you can confirm a fixed release, treat an in-range installation as affected; avoid relying on the scanner’s clean result as clearance.
Keep the earlier CVE-2025-6514 separate
The GitHub-reviewed advisory for CVE-2025-6514 describes OS command injection when connecting to an untrusted MCP server through crafted authorization_endpoint response URL input. It affects versions from 0.0.5 up to, but not including, 0.1.16; that advisory identifies 0.1.16 as patched for this earlier issue. It was published July 9, 2025 and reports CVSS 9.6 (Critical). This boundary is different from the five 2026 records: 0.1.16 is outside CVE-2025-6514’s affected range but is within the affected range of CVE-2026-51996 and CVE-2026-51997.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
