cve.nowby Sazabi

npmPackage

functype-mcp-server

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release: 1.25.1 (Nov 6, 2026): no advisory affects it
Newest unaffected release: 1.25.1 (Nov 6, 2026), the latest release
Advisories: 1 · 1 high

Weekly downloads: 1,068
Dependents: 0
Releases: 65 since 0.47.0 (Feb 23, 2026)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-59176
Affects 0.47.0 to 1.4.3 (1.4.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

CVE-2026-59176High 7.8
Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import
Affected: fixed in 1.4.4.
Fixed in 1.4.4 (released Jun 20, 2026, 130 days before disclosure).
The latest release, 1.25.1, is not affected.
10% of functype-mcp-server downloads last week were affected versions (106).