CVE-2025-65513: 
JavaScript vulnerability analysis and mitigation

CVE-2025-65513 is a Server-Side Request Forgery (SSRF) vulnerability in the fetch-mcp (npm package mcp-fetch-server) affecting versions 1.0.2 and earlier. The flaw allows unauthenticated, network-accessible attackers to bypass private IP validation and access internal network resources. It was published on December 9, 2025, with the GitHub Advisory added on December 10, 2025. The CVSS v3.1 base score is 7.5 (High), while the CVSS v4.0 score is 6.3 (Moderate) (Github Advisory, Feedly).

The root cause (CWE-918) lies in src/Fetcher.ts within the _fetch() method, where the private IP check calls is_ip_private(url) passing the full URL string (e.g., http://192.168.1.1/api/secrets) instead of just the hostname (e.g., 192.168.1.1). Because the is_ip_private() function expects a bare hostname or IP address, passing a full URL causes it to always return false, effectively disabling the SSRF protection entirely. Additionally, the is_ip_private dependency itself has reported CVE vulnerabilities, compounding the security risk. No authentication or special privileges are required to exploit this flaw — any attacker who can supply a URL to the MCP server can trigger it (Github Advisory, PoC Analysis).

Successful exploitation allows attackers to use the fetch-mcp server as a proxy to reach internal network resources that should be inaccessible from the internet, including administrative interfaces, internal APIs, and cloud metadata endpoints (AWS IMDSv1, GCP, Azure). In cloud environments, this is rated Critical severity, as attackers can retrieve cloud credentials (e.g., IAM tokens via http://169.254.169.254/latest/meta-data/) and potentially pivot to other internal services such as Redis, Memcached, or Elasticsearch. The primary impact is high confidentiality loss, with potential for lateral movement and internal service enumeration in enterprise deployments (PoC Analysis, Github Advisory).

Public proof-of-concept (PoC) exploit code and analysis are available on GitHub and Notion, published by Team Off-course (K-Shield Jr. 15th cohort) (PoC Analysis, Notion PoC). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a low current probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable by Qualys scanner (detection ID 5006564) (Feedly).

1. Identify target: Locate a deployment of mcp-fetch-server (npm package) version 1.0.2 or earlier that is accessible over the network and accepts user-controlled URLs.
2. Craft SSRF payload: Prepare a URL pointing to an internal resource, such as a cloud metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/) or an internal admin service (http://192.168.1.1/api/secrets).
3. Submit request: Invoke the Fetcher.html() or equivalent method with the crafted URL, e.g.:

   await Fetcher.html({ url: "http://192.168.1.1/api/secrets", headers: {} });

4. Bypass validation: Because is_ip_private() receives the full URL string rather than the hostname, it returns false and the request is not blocked.
5. Retrieve internal data: The server fetches the internal resource and returns its contents to the attacker, potentially exposing credentials, API keys, or sensitive configuration data (PoC Analysis).

• Network: Outbound HTTP requests from the fetch-mcp server process to RFC-1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.1), or cloud metadata IPs (169.254.169.254).
• Network: Unexpected connections from the MCP server to internal administrative ports (e.g., 6379/Redis, 9200/Elasticsearch, 11211/Memcached, 8080/admin panels).
• Logs: Application or proxy logs showing fetch requests to internal hostnames or private IP addresses initiated by the MCP server.
• Logs: HTTP responses containing cloud provider metadata tokens, IAM credentials, or internal API secrets returned through the MCP server.
• Process: The Node.js process running mcp-fetch-server making unusual outbound connections not consistent with normal external web fetching behavior (PoC Analysis).

The GitHub Advisory notes no patched version is currently listed for the npm package mcp-fetch-server, and users should monitor the repository for an updated release beyond version 1.0.2. As an immediate code-level fix, the call is_ip_private(url) in src/Fetcher.ts should be changed to is_ip_private(new URL(url).hostname) to pass only the hostname. Additionally, the is_ip_private dependency should be replaced with a more robust and actively maintained SSRF-prevention library. Operators should also implement network-level controls (egress filtering, firewall rules) to prevent the MCP server from reaching internal network ranges, and consider deploying the server in an isolated network segment (Github Advisory, PoC Analysis).

The vulnerability was discovered and reported by Team Off-course (K-Shield Jr. 15th cohort), a South Korean security training program, and published with a detailed technical write-up and PoC on GitHub. The advisory was picked up by Red Hat's CVE tracking and GitLab's advisory database, indicating moderate industry attention. No major vendor statements or significant social media discourse beyond automated CVE tracking posts have been identified (Github Advisory, PoC Analysis).