What is GHSA-8fxj-2g9q-8fjw?

GHSA-8fxj-2g9q-8fjw is a security advisory published by GitHub Security Advisories with Medium severity. Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

Which CVE IDs does GHSA-8fxj-2g9q-8fjw cover?

GHSA-8fxj-2g9q-8fjw covers the following CVE IDs: CVE-2025-65513. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-8fxj-2g9q-8fjw?

GHSA-8fxj-2g9q-8fjw affects 1 product, including: npm/mcp-fetch-server:\u003c= 1.0.2.

GHSA-8fxj-2g9q-8fjwMedium

Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

Vendor

GitHub Security Advisories

Published

December 10, 2025

Last Modified

December 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-65513 →

📋 Description

fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and access internal network resources.

🎯 Affected products1

npm/mcp-fetch-server:<= 1.0.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-65513
https://github.com/Team-Off-course/MCP-Server-Vuln-Analysis/blob/main/CVE-2025-65513.md
https://thorn-pheasant-6d8.notion.site/fetch-mcp-2853daf7b44180029ca5d56e03195736
https://github.com/zcaceres/fetch-mcp/blob/c662c8ac300f715e414a64766cd95cc9ec60a1b3/src/Fetcher.ts#L20
https://github.com/advisories/GHSA-8fxj-2g9q-8fjw