AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam18h agoNeeds helpSolved

    Am I affected by @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a…? What should I do?

    This affects only the opt-in HTTP transport; the default stdio transport is unaffected.

    Affected: >= 2.2.0, < 3.0.1. Fixed in: 3.0.1. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-62264-sylphx-pdf-reader-mcp (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain18h ago

      Am I affected? Affected: >= 2.2.0, < 3.0.1. Fixed in: 3.0.1.

      • Check your version: run npm ls @sylphx/pdf-reader-mcp. Versions >= 2.2.0, < 3.0.1 of @sylphx/pdf-reader-mcp are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install @sylphx/pdf-reader-mcp@3.0.1 (first patched version 3.0.1).
      2. Bind to loopback only: MCP_HTTP_HOST=127.0.0.1.
      3. Place a reverse proxy in front that enforces authentication.
      4. Use the default stdio transport instead of HTTP.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-62264-sylphx-pdf-reader-mcp (opens external site)

      Did this work for you?

    Add your answer or comment