vinkius-labs/mcp-fusion

v3.1.7 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 3mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

mcp mcp-framework mcp-server model-context-protocol

Affected surfaces

auth crypto_tls

Summary

AI summary

Fixed Group re‑parenting logic and timingSafeCompare implementation.

Full changelog

Bug Fixes (Medium #7-#11) + JWT Test Fix

Fixed

Bug #7 — Group.addChildGroup() now removes child from previous parent before re-parenting
Bug #8 — timingSafeCompare removes early return, uses constant-time XOR loop with length seeding
Bug #9 — autoValidator() detects async validators and throws descriptive error with vendor name
Bug #10 — mergeHooks wrapResponse now returns secondary's result instead of discarding it
Bug #11 — GroupedToolBuilder.tags() accumulates via push() consistently with FluentToolBuilder
JWT test — Signature corruption now targets middle char to avoid base64url padding bits

Tests

23 new regression tests across 2 test files
All 3363+ tests pass with 0 regressions

Security Fixes

timingSafeCompare now uses a constant‑time XOR loop, eliminating early returns

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track vinkius-labs/mcp-fusion

Get notified when new releases ship.

About vinkius-labs/mcp-fusion

A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.

All releases →

Related context

Related tools

Earlier breaking changes

v4.0.0 All packages now published under the `@mcpfusion` npm scope.
v4.0.0 GitHub repository renamed to vinkius-labs/mcpfusion; npm packages under @mcpfusion scope.
v4.0.0 All source code, documentation, CLI output, workflows, and npm packages now use the @mcpfusion scope.