[GHSA-8r9q-7v3j-jr4g] Correct affected version range for CVE-2026-0621

[albertabiev1]

Summary

The current advisory lists the affected version range as "introduced": "0" (all versions), which incorrectly flags versions of @modelcontextprotocol/sdk that do not contain the vulnerable code.

This PR changes the affected range from >= 0, < 1.25.2 to >= 1.3.0, < 1.25.2.

Evidence

The vulnerable UriTemplate class (specifically the partToRegExp() method containing the ReDoS-prone regex ([^/]+(?:,[^/]+)*)) was first introduced in commit 7f0cf730 ("URI Template parser and matcher"), which first shipped in version 1.3.0. The file src/shared/uriTemplate.ts does not exist in any earlier version.

Verified not affected (file src/shared/uriTemplate.ts absent, no URI template matching logic):

• 0.0.23
• 0.7.0
• 1.0.3
• 1.2.0

Verified affected (file present, vulnerable regex confirmed with ReDoS PoC):

• 1.10.0
• 1.25.1

References

• Commit introducing UriTemplate: 7f0cf730
• Fix commit: b392f02f
• Fix PR (v1.x backport): #1365
• Vendor advisory: GHSA-cqwc-fm46-7fff

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[advisory-database]

Hi @albertabiev1! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!