Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability
Date: 2025-12
Affected: npm/mcp-fetch-server
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-65513
CWE: CWE-918

fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and access internal network resources.


Mitigations:

Architectural layers (MAESTRO):