Repository navigation
🚨 Security: Critical or high vulnerabilities in onchain-mcp container #952
Description
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6 - Critical vulnerabilities: 0
- High vulnerabilities: 4
Details
See the Security tab for full details.
High Vulnerabilities
- GHSA-5jgf-p345-68v8 in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - GHSA-jqff-g426-hqxp in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization - GHSA-f65p-4m7j-42xc in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization - GHSA-fph4-wmhf-6fwf in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Automated security scan from periodic-security-scan workflow
Activity
github-actions commentedon Sep 14, 2026
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6Details
See the Security tab for full details.
High Vulnerabilities
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesfast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalizationfast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationfast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingAutomated security scan from periodic-security-scan workflow
github-actions commentedon Sep 21, 2026
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6Details
See the Security tab for full details.
High Vulnerabilities
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesfast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalizationfast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationfast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingAutomated security scan from periodic-security-scan workflow
github-actions commentedon Sep 28, 2026
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6Details
See the Security tab for full details.
High Vulnerabilities
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesfast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalizationfast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationfast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingAutomated security scan from periodic-security-scan workflow
github-actions commentedon Oct 5, 2026
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6Details
See the Security tab for full details.
High Vulnerabilities
axios@1.19.0: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsaxios@1.19.0: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Locationaxios@1.19.0: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initializationaxios@1.19.0: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFaxios@1.19.0: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)... and 7 more. See Security tab for complete list.
Automated security scan from periodic-security-scan workflow