Vulnerability RUSTSEC-2026-0140

dynoxide's MCP HTTP transport was vulnerable to DNS rebinding via its transitive rmcp dependency, plus a related cross-origin CSRF gap.

A malicious web page could make the user's browser send requests to a local dynoxide mcp --http or dynoxide serve --mcp server with a non-loopback Host header, which the server would then process. The Host check alone did not close a related cross-origin CSRF vector: a page could fetch the loopback endpoint with mode: 'no-cors', and the Host header would match while the Origin header went unchecked.

Affected MCP write tools include put_item, update_item, delete_item, create_table, and batch_write_item.

The stdio transport (dynoxide mcp without --http) is not affected.

Patches

dynoxide 0.9.13 closes both vectors:

• Upgrades rmcp from 1.1.1 to 1.6.0 (which ships a default Host-header allowlist).
• Sets explicit allowed_hosts and allowed_origins on StreamableHttpServerConfig.