mcp-from-openapi vulnerabilities (npm)

2 vulnerabilities.

• mcp-from-openapi npm mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi CVE-2026-59973 Fix available 8.5 HighSeptember 11, 2026
• mcp-from-openapi npm FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications CVE-2026-39885 Fix available 7.5 HighApril 8, 2026