If you use mcp-remote from versions 0.1.16 through 0.1.38, check the exact version you run against five OSV vulnerability records published in September 2026. A clean dependency-scanner report is not proof that you are unaffected: these records identify the Git repository rather than an npm package with a conventional semantic-version range, which may affect how some tools match them. That is a reason to verify your scanner’s coverage—not evidence that every scanner misses them.
What the five advisories cover
OSV lists five records published on September 24, 2026, and modified on September 26, 2026. Their affected ranges differ, so compare your resolved version with each range rather than treating 0.1.16–0.1.38 as one identical exposure.
As an Amazon Associate I earn from qualifying purchases.
| Advisory | Affected mcp-remote versions | Issue described by OSV | CVSS score reported by OSV |
|---|---|---|---|
| CVE-2026-51994 | 0.1.32–0.1.38 | SSRF through the resource_metadata URL taken from a remote MCP server’s WWW-Authenticate header |
9.1 |
| CVE-2026-51995 | 0.1.32–0.1.38 | Sensitive-information exposure involving authorization-server-metadata.ts and utils.ts |
7.5 |
| CVE-2026-51996 | 0.1.16–0.1.38 | Arbitrary code execution involving getServerUrlHash |
Not stated by OSV |
| CVE-2026-51997 | 0.1.16–0.1.38 | Arbitrary code execution involving open() functions |
8.8 |
| CVE-2026-52001 | 0.1.18–0.1.38 | Sensitive-information exposure involving the SSE transport eventSourceInit fetch wrapper |
Not stated by OSV |
OSV gives all five records the same fixing commit: 02619aff36e79803d7c894e8c8ae7b34b2d11f8c. The reviewed records do not establish which published npm release contains that commit, so do not assume a particular release number is fixed without checking the project’s release information.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhy a scanner may show no finding
For these five records, OSV identifies the affected package through Git repository metadata and version ranges. The earlier CVE-2025-6514 record, by contrast, is represented as an npm package with a SEMVER range. That metadata difference could matter to tools that only match npm-ecosystem advisories or that do not associate repository-based records with an npm dependency.
#1 Best Overall
- Windows Hello for Windows 10/11 - Only works with Windows Hello on Windows 10/11 PCs and laptops. Plug the USB fingerprint reader into your computer and sign in with one touch. Not compatible with Mac, macOS, Linux or Chrome OS.
- Plug-and-Play Fingerprint Login - No extra app is needed on most genuine Windows systems. Insert the USB fingerprint scanner, set up fingerprint sign-in through Windows Hello, and unlock your PC without typing long passwords every time.
- Fast 0.5s 360° Recognition - Capacitive fingerprint technology supports quick authentication in about 0.5 seconds. 360° touch recognition helps read your fingerprint from different angles for faster, smoother daily login.
- Compact Scanner for PC & Laptop + Multi-User Support - Small, lightweight USB design works well for desktops, laptops, office PCs and shared home computers without built-in fingerprint sensors. Supports multiple Windows accounts and up to 10 fingerprints per user account. Smart-ID security helps protect saved passwords and encrypted folders with fingerprint access.
- Important Notes — Please Read Before Purchase - Support for Win10/11 32/64 bit original system. Not fit for the streamlined version. The Lite version has trimmed the biometric component, the fingerprint login device will not be able to recognize the Hello fingerprint option.It merely supports Windows Hello, does not fit for encrypting USB drives/files, and can merely support Windows system.It is recommended to prioritize plugging into the USB 2.0 interface of the motherboard. USB 3.0 docking stations are prone to power supply/interference and unstable recognition.
This is a plausible coverage gap, not a verified result for any named scanner. Scanner feeds and matching behavior vary and can change. Check whether your tool currently ingests these exact advisory IDs and how it maps GitHub repository metadata to the installed npm package. A report with no finding cannot answer those questions by itself.
How to check whether you are affected
- Find where you invoke it. Search MCP client configuration files and relevant repositories for
mcp-remote. Include configuration that launches it throughnpx, as well as project dependencies. - Identify the version actually resolved or run. Inspect the project lockfile, not just a broad version range in
package.json. If the client runs it throughnpx, inspect the applicable local npx cache as well. The relevant locations depend on how and where the client launches the package. - Match that version to each row in the table. Versions 0.1.32–0.1.38 fall within all five listed ranges; versions 0.1.18–0.1.31 fall within CVE-2026-51996, CVE-2026-51997, and CVE-2026-52001; versions 0.1.16–0.1.17 fall within CVE-2026-51996 and CVE-2026-51997. These comparisons apply to the ranges listed by OSV.
- Verify scanner coverage explicitly. Search the scanner’s current advisory feed or vulnerability results for CVE-2026-51994, CVE-2026-51995, CVE-2026-51996, CVE-2026-51997, and CVE-2026-52001. Confirm both that the records are present and that the tool can match them to the package as installed—not merely that it reports no vulnerability.
- Confirm the fixed release before upgrading to a specific version. The records identify a fixing commit, but the reviewed information does not map it to a published npm release. Check the project’s release notes or package history for that commit, then pin or resolve to a release confirmed to include it.
Keep the older CVE-2025-6514 separate
GitHub’s reviewed advisory for CVE-2025-6514 describes OS command injection when connecting to an untrusted MCP server, caused by crafted input from the authorization_endpoint response URL. It affects versions from 0.0.5 up to, but not including, 0.1.16; GitHub lists 0.1.16 as patched and reports a CVSS score of 9.6 (Critical). The advisory was published July 9, 2025. This earlier issue has a different boundary from the five 2026 records and should not be used to infer their fixed release.
Rank #2
- FIDO U2F certified, and FIDO2 WebAuthn compatible for expanded authentication options, including strong single-factor (passwordless), dual, multi-factor, and Tap-and-Go support across major browsers (for services leveraging the older FIDO U2F standard, instead of using biometric authentication, Tap-and-Go allows the user to simply place their finger on the VeriMark Desktop Fingerprint Key to enable a security token experience).
- Windows Hello certified (includes Windows Hello for Business) for seamless integration. Also compatible with additional Microsoft services including Office365, Microsoft Entra ID, Outlook, and many more. Windows ARM-based computers are currently not supported. Please check back for future updates on compatibility
- Encrypted end-to-end security with Match-in-Sensor Fingerprint Technology combines superior biometric performance and 360° readability with anti-spoofing technology. Exceeds industry standards for false rejection rate (FRR 2%) and false acceptance rate (FAR 0.001%).
- Long (3.9 ft./1.2m) USB Cable provides the flexibility to be placed virtually anywhere on or near the desktop.
- Can be used to support cybersecurity measures consistent with (but not limited to) such privacy laws and regulations as GDPR, BIPA, and CCPA. Ready for use in U.S. Federal Government institutions and organizations.
What to do with a clean report
Treat a clean report as inconclusive until you have checked the resolved or cached version and verified how your scanner handles these records. If your installed version falls in an affected range, use upstream release information to identify a release containing the fixing commit before deciding what version to deploy. The available advisory information supports neither a product-by-product scanner comparison nor a claim that a specific scanner misses these CVEs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Rank #4
- Certified to Microsoft’s highest fingerprint security standards (ESS & SDCP) for robust, hardware-isolated authentication. Supports next-gen Windows features, including Copilot Recall and Windows Hello with ESS support.
- Windows Hello ready for fast, password free fingerprint login to Windows and Microsoft 365 accounts
- On device fingerprint storage keeps biometric data securely within the key. Supports privacy regulations (GDPR, BIPA, CCPA) through on device biometric processing; TAA compliant.
- Reliable wired USB fingerprint authentication with USB C and USB A compatibility for desktop PCs.
- Consistent, all condition 360° fingerprint recognition.
Rank #3
- 1. 【Multi-Functional USB-C Hub & Security】** Upgraded design features a built-in **USB-C pass-through charging and data port**. Unlike basic fingerprint scanners, this allows you to simultaneously use your fingerprint login while keeping your USB-C port free for charging your laptop or connecting a wireless mouse/keyboard. Perfect for modern laptops with limited ports.
- 2. 【Premium Aluminum Build & Portability】** Crafted from a **durable aluminum alloy** casing, this scanner is built to withstand the rigors of daily travel and desk life. Included **3M adhesive backing** allows you to securely mount it to your laptop lid or desk, ensuring it stays put in your bag and is always ready for instant access.
- 3. 【Instant Windows Hello Login (<1 Sec)】** Experience **password-less login in under one second**. With full support for **Windows 10/11 and Windows Hello**, this biometric reader provides seamless, secure access to your device, apps, and websites. Just a touch and you're in—no more typing complex passwords in coffee shops or airports.
- 4. 【360° Touch & Data Pass-Through】** Equipped with **360-degree capacitive touch** technology, it reads your fingerprint accurately from any angle. The upgraded USB-C port supports **data synchronization**, allowing you to connect and read a flash drive or external hard drive through the scanner without any loss in speed.
- 5. 【Universal Compatibility for On-the-Go Pros】** Designed for modern hybrid workers. Simply plug-and-play on any **Windows 10/11 laptop or PC** with a USB-C port. No complicated setup required. The compact size and detachable cable (with the adhesive mount) make it the ideal security companion for business travel and hot-desking.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
