vinkius-labs/mcp-fusion

v3.1.18 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 3mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

mcp mcp-framework mcp-server model-context-protocol

Affected surfaces

auth

Summary

AI summary

Fixed token file permission leak on Windows and several validation/serialization bugs.

Full changelog

Fixed

TokenManager now restricts file permissions on Windows via icacls - mode 0o600 is silently ignored on NTFS, so saved tokens and device codes were readable by any local user
ZodCompiler.compileArray() now prefers minItems/maxItems over legacy minLength/maxLength for array constraints - previously emitted incorrect validation for arrays
HttpHandlerFactory no longer adds Content-Type application/json to GET and HEAD requests - prevents servers from rejecting body-less requests
RefResolver deep-clones ref targets before recursive resolution - multiple refs to the same definition no longer share a single mutable object
ToolSynthesizer.toToolName() (n8n) now throws when the sanitized name is empty - previously returned empty string, producing an invalid MCP tool definition

Security Fixes

TokenManager now restricts file permissions on Windows to mode 0o600, preventing readable tokens by any local user

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track vinkius-labs/mcp-fusion

Get notified when new releases ship.

About vinkius-labs/mcp-fusion

A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.

All releases →

Related context

Related tools

Earlier breaking changes

v4.0.0 All packages now published under the `@mcpfusion` npm scope.
v4.0.0 GitHub repository renamed to vinkius-labs/mcpfusion; npm packages under @mcpfusion scope.
v4.0.0 All source code, documentation, CLI output, workflows, and npm packages now use the @mcpfusion scope.