v2.9.0 — Enhanced SSRF Protection

This release focuses on enhancing SSRF security and updates to dependencies. In total, 127 lines were added spanning four updated files.

✨ Highlights

• Improved hostname normalization. Ensures safer $ref resolution by normalizing hostnames case-insensitively.

  import { hostListIncludes } from './ssrf';
  hostListIncludes(['api.example.com'], 'API.EXAMPLE.COM');

🔒 Security

• Fixed SSRF vulnerability by blocking specific IPv6 flows.
• Enhanced SSRF protection through improvements in spec credential handling.

🙏 Thanks

Thanks to @zachariah-mithani for responsibly disclosing the cross-origin credential forwarding and the blockedHosts trailing-dot bypass fixed in this release (GHSA-ff5q-5r4v-fw4v).

🛠 Also in this release

• Bumped @apidevtools/json-schema-ref-parser to stay updated.
• Upgraded several development dependencies.

⚠️ Upgrading

Change	Impact
Host normalization/rewriting	Host comparison now case- and trailing-dot-insensitive.

Full change list

Features

• chore(release): initialize release/2.9.x at v2.9.0

Fixes

• fix(ssrf): never let a public ::ffff: tail allow a blocked IPv6 prefix
• fix(ssrf): keep spec credentials on their origin and normalize host lists

Security

• fix(ssrf): never let a public ::ffff: tail allow a blocked IPv6 prefix
• fix(ssrf): keep spec credentials on their origin and normalize host lists

Chores

• chore(deps): bump @apidevtools/json-schema-ref-parser
• chore(deps-dev): bump the dev-dependencies group with 4 updates
• chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates

Installation

npm install mcp-from-openapi@2.9.0

---

_{Release line: 2.9.x · Branch: release/2.9.x · Type: stable}