MCP servers v2.1.0 fixes eight security flaws

The modelcontextprotocol/servers repository published v2.1.0 on October 25, 2026 (Istanbul time). It is a security release: eight vulnerabilities across three reference servers, each with its own GitHub security advisory. If you run the filesystem server, the everything server over HTTP, or the Python fetch server, upgrade now. It follows v2.0.0 from October 19, which moved the TypeScript servers to the TypeScript SDK v2 and raised their Node floor to 24.

Release facts

What changed

Filesystem server 2.0.1 (four advisories):

• Symlink swap during writes. On Linux and macOS, a parent directory replaced by a symlink between the access check and the write can no longer redirect write_file, edit_file, create_directory or the move_file destination outside the allowed directories. The release notes say Windows is only partly fixed and point to the advisory for the remaining exposure and a configuration workaround.
• Trailing quotes and whitespace. The access check no longer strips characters the file operation keeps, so a sibling directory named like an allowed one plus that suffix is no longer reachable.
• Case-insensitive volumes. A symlink spelled in a different letter case no longer passes the symlink check on volumes such as the macOS default. The notes call this a regression from 2026.8.31.
• Directory listings. list_directory_with_sizes checks each entry before reading its size, so a symlink inside an allowed directory no longer leaks the size and modification time of a file outside it.

Everything server 2.0.1 (one advisory): the HTTP and SSE transports now check the Origin header and stop sending Access-Control-Allow-Origin: *. Before the fix, a web page the user visited could call the server's tools, such as get-env, and read the results.

Fetch server 2026.10.24 (three advisories):

• The address check and the connection now use the same form of an internationalized (IDNA) host name, which previously could let a request reach an internal address.
• NAT64 addresses in 64:ff9b::/96 that wrap a private, loopback or link-local IPv4 address are refused.
• robots.txt is checked again after every redirect, not only for the first URL.

The upgrade trap

The TypeScript servers switched from date versions (2025.x, 2026.x) to semantic versions at 1.0.0. Because package managers rank 2.0.1 below every date version, they will not offer it as an upgrade if you are still on a date-versioned release. Install it explicitly, for example npm install @modelcontextprotocol/server-filesystem@2.0.1.

Questions

Which MCP servers need updating after v2.1.0? Three: @modelcontextprotocol/server-filesystem and @modelcontextprotocol/server-everything to 2.0.1, and mcp-server-fetch to 2026.10.24. Memory, sequential-thinking, git and time are unchanged.

Is the filesystem server fully fixed on Windows? No. The release notes say the symlink-swap fix is only partial on Windows and refer to advisory GHSA-53mr-w429-c597 for what remains exposed and how to configure around it.

Why doesn't npm offer 2.0.1 as an update? Date versions such as 2026.8.31 sort above 2.0.1, so npm update will not move you to it. Pin the version explicitly.

See the Model Context Protocol Servers hub, the earlier v1.0.0 release, the MCP servers category and the GitHub MCP server vs reference MCP servers comparison.