The CVE Ids Landed After npm 2.9.0.

The package is npm mcp-from-openapi, repository agentfront/mcp-from-openapi. VulnCheck published CVE-2026-115750 at 13:03:32.783 UTC on 23 October and CVE-2026-115751 at 13:03:33.492 UTC, 0.709 sec later. Both were reserved at 12:59:06 UTC the same hour. npm 2.9.0 had already uploaded at 03:12:29.393 UTC on 20 October. GHSA-ff5q-5r4v-fw4v published at 03:22:53 UTC that morning, and a read tonight still has cve_id null.

US trends at 22:10 UTC were UFC 333 and college football. Hacker News did not have this package on the front page. The primary is the pair of CVE records plus the repository advisory, not a trade-press rewrite.

Medium Medium because both CVE records score CVSS 4.0 at 6.3, with attack requirements present and confidentiality low. GitHub labels the same advisory low and publishes only the CVSS 3.1 score of 3.7. Those are two scores on one row. A scanner that keeps a single number has to say which one.

The fix shipped, then the ids.#

Pull 42 merged at 03:08:40 UTC on 20 October. The title is fix(ssrf): keep spec credentials on their origin and normalize host lists. The merge commit is cb155019d5be. Author on the pull is frontegg-david, which is also the remediation credit on the GHSA. Commit 47fb7a655de3, the SHA both CVE records cite, is committer 02:10:42 UTC the same day. Compare of that commit to the merge is ahead 2, behind 0. Compare of the merge to tag v2.9.0 is ahead 2, behind 0. The fix commit is an ancestor of the tag. Compare of tag v2.8.0 to 47fb7a6 is diverged: ahead 7, behind 2. The fix is not in 2.8.0.

GitHub release v2.9.0 published at 03:11:40 UTC. npm 2.9.0 uploaded at 03:12:29.393 UTC, 49.393 sec later. The GHSA published at 03:22:53 UTC, 10 min 23.607 sec after that upload. From the fix commit to the GHSA is 1 hour 12 min 11 sec. From npm 2.9.0 to CVE-2026-115750 is 3 days 9 hours 51 min 3.390 sec. The GHSA body, read tonight, is an administrative transfer of a private report saved 16 October. It says the version statements reflect that review date, not a fresh 19 October check, and that no new tests were run for the filing. The transferred text calls 2.8.0 latest. Registry latest tonight is 2.9.1.

The v2.9.0 notes thank zachariah-mithani for the cross-origin credential forwarding and the blockedHosts trailing-dot bypass fixed in that release, and they name this GHSA. The same notes also say the release blocks a specific IPv6 flow. That sentence has no CVE id. This brief did not re-test either path and does not print the redirect loop or a hostname.

Three floors, one tag.#

The GHSA vulnerability row is npm mcp-from-openapi at <= 2.8.0, patched 2.9.0. Weaknesses on that object are CWE-183 and CWE-522. CVE-2026-115750 is CWE-522, affected from 2.5.0 before 2.9.0, package URL pkg:npm/mcp-from-openapi. CVE-2026-115751 is CWE-184, affected from 2.2.0 before 2.9.0. The GHSA does not list CWE-184. datePublic on both CVE records is null. Finder credit on both is Zachariah Mithani (AploSec), matching the GHSA reporter login zachariah-mithani.

npm times on the boundaries: 2.2.0 at 22:12:18.051 UTC on 7 April, 2.5.0 at 21:53:53.868 UTC on 21 June, 2.8.0 at 00:14:16.244 UTC on 26 September, 2.9.0 at 03:12:29.393 UTC on 20 October, 2.9.1 at 03:46:37.813 UTC on 20 October. There is no 2.8.1. Version 2.4.0 uploaded at 21:09:37.375 UTC on 18 June. It sits inside the GHSA range and inside the CVE-2026-115751 floor, and it sits before the CVE-2026-115750 floor. This brief did not bisect 2.4.0, 2.2.0, or 2.5.0. The transferred report says the confirmation target was 2.8.0.

v2.9.1 published at 03:45:50 UTC. The notes resolve Dependabot alerts on @istanbuljs/load-nyc-config and js-yaml. Compare of 47fb7a6 to v2.9.1 is behind, ahead 0, so the October fix is in that tag too. The floor for these two issues is still 2.9.0. Registry modified is 03:46:38.216 UTC on 20 October. Nothing on npm has moved since.

The unauthenticated URL https://api.github.com/advisories/GHSA-ff5q-5r4v-fw4v returns 404. The repository security-advisories API returns the row. A consumer that only polls the global id will miss it even after the CVE records exist, because those records do not rewrite cve_id on the GHSA. updated_at is still the publish second.

1. 2026-09-26
   GHSA-rm2m-wfw5-7wp5 at 00:13:04 UTC. Range at or below 2.5.1, patched 2.8.0. npm 2.8.0 at 00:14:16.244 UTC. cve_id null.
2. 2026-10-16
   The GHSA body says the private report was saved this day. The transferred text still calls 2.8.0 latest.
3. 2026-10-20
   Commit 47fb7a6 at 02:10:42 UTC. Pull 42 merges 03:08:40. Release 03:11:40. npm 2.9.0 at 03:12:29.393. GHSA at 03:22:53. npm 2.9.1 at 03:46:37.813.
4. 2026-10-23
   Both CVEs reserved 12:59:06 UTC and published 13:03:32 and 13:03:33 UTC. GHSA cve_id still null tonight.

What to pin tonight.#

1. The floor for the credential redirect and the trailing-dot host list is npm mcp-from-openapi@2.9.0. Tonight latest is 2.9.1. Both tags contain commit 47fb7a6. Tag v2.8.0 does not.
2. Keep GHSA-rm2m-wfw5-7wp5 on its own pin: at or below 2.5.1, patched 2.8.0, published 26 September, cve_id null. Installing 2.8.0 because that row says patched does not install the 20 October fix.
3. Match ranges without collapsing them. The GHSA says at or below 2.8.0. CVE-2026-115750 says from 2.5.0 before 2.9.0. CVE-2026-115751 says from 2.2.0 before 2.9.0. Version 2.4.0 is inside two of those and outside one. This brief did not bisect, and the advisory text says the executed check was 2.8.0.
4. A CVE-only feed was empty until 13:03:32.783 UTC on 23 October. Reserve to publish on the first id is 4 min 26.467 sec. The GHSA object was 3 days 9 hours 40 min 39.783 sec old by then, and it still has cve_id null. Poll the repository advisory list. The global advisory URL 404s.
5. The package clock is the tag you resolve now. The impact clock is a spec fetch, before 2.9.0, that already forwarded a caller header onto another origin, or a denylist that compared the hostname string and missed the trailing-dot form. Upgrading does not unsend that header. Neither CVE record includes an attack count. This brief does not add one.
6. v2.9.1 is a dependency bump on top of the floor, not a third floor. The IPv6 sentence in the 2.9.0 notes is a third fix in the same tag and has no id here. Pinning 2.9.0 or newer covers the two named records. It does not close a GHSA this brief did not open.