auth-fetch-mcp vulnerabilities (npm)

2 vulnerabilities.

• auth-fetch-mcp npm auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback CVE-2026-49857 Fix available 7.4 HighJuly 1, 2026
• auth-fetch-mcp npm auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs GHSA-hv85-774v-26fg Fix available 8.2 HighMay 19, 2026