The published tree of @cloudflare/mcp-server-cloudflare@0.2.0 resolves undici@5.29.0 as a direct dependency. That version carries 12 open advisories.
@cloudflare/mcp-server-cloudflare@0.2.0
└─ undici@5.29.0
This is a follow-up to #333, which was self-closed by its reporter. A fresh install on 2026-08-06 still resolves the same direct dependency from the current, non-deprecated npm package.
HIGH
GHSA-v9p9-hfj2-hcw8 — unhandled exception in the WebSocket client on invalid server_max_window_bits (fixed 6.24.0)GHSA-vrm6-8vpv-qv8q — unbounded memory consumption in WebSocket permessage-deflate decompression (fixed 6.24.0)GHSA-vxpw-j846-p89q — WebSocket DoS via fragment-count bypass (fixed 6.27.0)
MEDIUM
GHSA-2mjp-6q6p-2qxm — request/response smugglingGHSA-4992-7rv2-5pvq — CRLF injection via upgradeGHSA-8xcm-r25x-g524 — response desynchronization via retry interceptorGHSA-m8rv-5g2x-5cg5 — CRLF injection via blob body typeGHSA-p88m-4jfj-68fv — header injection via Set-Cookie percent-decodingGHSA-v3r7-h72x-cjcm — cookie attribute injectionGHSA-g9mf-h72j-4rw9 — unbounded decompression chain (fixed 7.18.2)
LOW
GHSA-35p6-xmwp-9g52 — keep-alive response queue poisoningGHSA-g8m3-5g58-fq7m — SameSite downgrade via substring matching
The fix versions are not uniform:
| Target |
Clears |
6.24.0 |
4 of 12 |
6.27.0 |
8 of 12 |
6.28.0 |
11 of 12 |
7.18.2 |
12 of 12 |
^7.18.2 clears the set; ^6.28.0 leaves GHSA-g9mf-h72j-4rw9. Either way, 5 → 6 is a major upgrade, so this needs a compatibility check rather than a lockfile refresh.
Separately, and not the subject of this issue: the tree also pins @modelcontextprotocol/sdk@0.6.1, which carries GHSA-w48q-cv73-mx4w (DNS rebinding protection not enabled by default, HIGH, fixed in 1.24.0). Happy to open that separately if it is useful.
Found while scanning MCP servers for dependency CVEs. Happy to share the full output.
The published tree of
@cloudflare/mcp-server-cloudflare@0.2.0resolvesundici@5.29.0as a direct dependency. That version carries 12 open advisories.This is a follow-up to #333, which was self-closed by its reporter. A fresh install on 2026-08-06 still resolves the same direct dependency from the current, non-deprecated npm package.
HIGH
GHSA-v9p9-hfj2-hcw8— unhandled exception in the WebSocket client on invalidserver_max_window_bits(fixed6.24.0)GHSA-vrm6-8vpv-qv8q— unbounded memory consumption in WebSocket permessage-deflate decompression (fixed6.24.0)GHSA-vxpw-j846-p89q— WebSocket DoS via fragment-count bypass (fixed6.27.0)MEDIUM
GHSA-2mjp-6q6p-2qxm— request/response smugglingGHSA-4992-7rv2-5pvq— CRLF injection viaupgradeGHSA-8xcm-r25x-g524— response desynchronization via retry interceptorGHSA-m8rv-5g2x-5cg5— CRLF injection via blob body typeGHSA-p88m-4jfj-68fv— header injection via Set-Cookie percent-decodingGHSA-v3r7-h72x-cjcm— cookie attribute injectionGHSA-g9mf-h72j-4rw9— unbounded decompression chain (fixed7.18.2)LOW
GHSA-35p6-xmwp-9g52— keep-alive response queue poisoningGHSA-g8m3-5g58-fq7m— SameSite downgrade via substring matchingThe fix versions are not uniform:
6.24.06.27.06.28.07.18.2^7.18.2clears the set;^6.28.0leavesGHSA-g9mf-h72j-4rw9. Either way, 5 → 6 is a major upgrade, so this needs a compatibility check rather than a lockfile refresh.Separately, and not the subject of this issue: the tree also pins
@modelcontextprotocol/sdk@0.6.1, which carriesGHSA-w48q-cv73-mx4w(DNS rebinding protection not enabled by default, HIGH, fixed in1.24.0). Happy to open that separately if it is useful.Found while scanning MCP servers for dependency CVEs. Happy to share the full output.