vinkius-labs/mcp-fusion

v3.1.17 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 3mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

mcp mcp-framework mcp-server model-context-protocol

Affected surfaces

auth rce_ssrf

Summary

AI summary

Fixed prototype pollution via poisoned discriminator and exposed hidden tool names.

Full changelog

Fixed

SandboxEngine abort handler no longer disposes the shared isolate when concurrent executions are in flight — prevents collateral 'Isolate was disposed' errors misclassified as MEMORY
SandboxEngine output size guard now uses UTF-8 byte length (TextEncoder) instead of .length (UTF-16 code units) — correctly rejects CJK/emoji output that exceeds maxOutputBytes
ExecutionPipeline discriminator re-injection now guards against proto, constructor, and prototype names — prevents prototype pollution via poisoned discriminator configuration
EgressGuard byte-level truncation now backtracks to a valid UTF-8 character boundary instead of producing U+FFFD replacement characters for incomplete multi-byte sequences
ToolRegistry.routeCall no longer leaks all registered tool names in the 'unknown tool' error response — prevents exposing tools hidden by tag-based filtering; suggests tools/list instead
JwtVerifier now accepts an algorithm field in JwtVerifierConfig for public key verification — no longer hardcoded to RS256, enabling ES256/ES384/ES512 elliptic curve keys

Security Fixes

ExecutionPipeline discriminator re-injection now guards against __proto__, constructor, and prototype names — prevents prototype pollution via poisoned discriminator configuration
ToolRegistry.routeCall no longer leaks all registered tool names in the 'unknown tool' error response — prevents exposing tools hidden by tag-based filtering

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track vinkius-labs/mcp-fusion

Get notified when new releases ship.

About vinkius-labs/mcp-fusion

A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.

All releases →

Related context

Related tools

Earlier breaking changes

v4.0.0 All packages now published under the `@mcpfusion` npm scope.
v4.0.0 GitHub repository renamed to vinkius-labs/mcpfusion; npm packages under @mcpfusion scope.
v4.0.0 All source code, documentation, CLI output, workflows, and npm packages now use the @mcpfusion scope.