RUSTSEC-2026-0140: DNS rebinding and cross-origin CSRF in dynoxide's MCP HTTP transport

What to do

1. See which version you have: cargo tree -i dynoxide-rs (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p dynoxide-rs. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example dynoxide-rs = "0.9.13") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

dynoxide's MCP HTTP transport was vulnerable to DNS rebinding via its transitive rmcp dependency, plus a related cross-origin CSRF gap.

A malicious web page could make the user's browser send requests to a local dynoxide mcp --http or dynoxide serve --mcp server with a non-loopback Host header, which the server would then process. The Host check alone did not close a related cross-origin CSRF vector: a page could fetch the loopback endpoint with mode: 'no-cors', and the Host header would match while the Origin header went unchecked.

Affected MCP write tools include put_item, update_item, delete_item, create_table, and batch_write_item.

The stdio transport (dynoxide mcp without --http) is not affected.

Patches

dynoxide 0.9.13 closes both vectors:

• Upgrades rmcp from 1.1.1 to 1.6.0 (which ships a default Host-header allowlist).
• Sets explicit allowed_hosts and allowed_origins on StreamableHttpServerConfig.

References

• Package: crates.io/crates/dynoxide-rs
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0140.html
• Web: github.com/nubo-db/dynoxide/commit/10292083fd16fe7116e9089ffa189f4f4f071e0f
• Web: github.com/nubo-db/dynoxide/releases/tag/v0.9.13

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.