A new security update for the MCP server collection fixes 8 vulnerabilities in file access and web request handling. Developers running file or web retrieval servers can install each component's fixed version to limit unauthorized access.

1. Fixes for 8 vulnerabilities across three servers

Release notes published on October 25 list 4 fixes in the filesystem server, 1 in Everything, and 3 in Fetch. The fixes cover distinct access routes: file operations, tool calls from web pages, and requests for external resources.

The fixes share a focus on matching the checked target to the actual operation target. File access stays within allowed directories, while web requests undergo checks of their origins and final connection addresses.

2. Keeping filesystem operations within allowed paths

The filesystem server fixes a mismatch between checked directories and write targets. A symbolic link points to another path. Writes, edits, directory creation, and moves stay in allowed areas even if a parent becomes a link after checks.

Path checks no longer strip trailing quotes or spaces. Checks and file operations now use matching paths, blocking access to sibling directories whose names append those characters to an allowed directory's name.

On case-insensitive storage, a fix also prevents symbolic links differing only in letter case from passing checks when creating paths. The notes cite the default macOS setup and say the issue began in version 2026.8.31.

The feature that lists files and sizes now checks access permissions for each entry first. This prevents symbolic links inside allowed areas from exposing the sizes and modification times of files outside them.

3. Rechecking web request origins and connection addresses

Everything now rejects cross-origin web requests. It checks Origin, which identifies a request's web origin, and stops sending responses that allow all origins. This blocks visited web pages from calling server tools or reading results.

Fetch now uses the same hostname for address checks and connections. This fixes access to internal addresses through differences in how internationalized domain names, which use non-ASCII characters, were checked and connected to.

It also checks NAT64 addresses in the 64:ff9b::/96 range, which embed IPv4 addresses in IPv6 addresses. Connections are rejected if the embedded address points to private, internal-only, loopback, or link-local networks.

Each redirect to another address also triggers a fresh check of the destination's robots.txt. Previously, the site's access rules for automated retrieval were checked only at the initially requested address.

4. Date-version users must specify versions explicitly

File operations and web requests gain stricter access boundaries, but operators of date-versioned TypeScript servers must explicitly install fixed versions. Write-target protection applies to Linux and macOS, with only partial fixes on Windows.

The fixed version for filesystem and Everything is 2.0.1. TypeScript servers moved from date-based to semantic versioning, where numbers convey the meaning of changes. Package managers rank this below existing date versions and offer no upgrade.

npm install @modelcontextprotocol/server-filesystem@2.0.1

Fetch versions through 2026.10.19 are affected; the fixed version is 2026.10.24. Unlike the filesystem servers, Fetch retains date-based versions. Check and apply each component's fixed version rather than align all three version numbers.

Addressing the 8 vulnerabilities requires checking each server's version, and users of date-based versions must specify fixed versions rather than rely on automatic updates.