MCP servers v2.4.0 fixes six flaws in filesystem, git, fetch

The modelcontextprotocol/servers repository published v2.4.0 on November 11, 2026, a week after v2.3.0. It is the second security release in three weeks after v2.1.0: six vulnerabilities across the filesystem, git and fetch reference servers, each with its own GitHub advisory. The one to act on first is in mcp-server-git, where a read-only call on an untrusted repository could run a program named in that repository's own Git config.

Release facts

Upgrade these three

On a date-versioned filesystem server? The TypeScript servers switched from date versions to semantic versions in 1.0.0, and package managers rank 2.3.0 below every 2025.x and 2026.x version, so npm update will not offer it. Install it explicitly with npm install @modelcontextprotocol/server-filesystem@2.3.0.

The six fixes

• Git: repository config can no longer run programs (GHSA-6hqx-gqrx-c5r2). A call such as git_status used to honour core.fsmonitor, diff.external, hooks, filter and merge drivers and signing settings from .git/config, with the server's privileges. Every Git command now overrides them, and a Git older than 2.31, which would ignore the overrides, is refused. If your agent opens repositories it did not create, this is the urgent one.
• Git: --repository confinement closed three escapes (GHSA-q74p-4wrc-q7w6). Alternate object stores, linked worktrees and symlinks inside a Git directory could reach outside the allowed repository. All are refused now. Windows directory junctions are not covered yet.
• Filesystem: reads stay with the file that was checked (GHSA-p9cv-8g75-4xcg). Swapping a directory for a symlink between the access check and the read could return a file from outside the allowed directories. Closed on Linux and macOS; on Windows the race is only narrowed. FIFOs, sockets and devices are now refused.
• Filesystem: move_file moves only the source it checked (GHSA-7m4x-rv66-mxhh), so a swapped source can no longer pull an outside file into the allowed directories.
• Fetch: IPv6 site-local addresses count as private (GHSA-3rxj-6jhw-qfv7). fec0::/10 was treated as public; any IPv6 address outside 2000::/3 that does not carry an IPv4 address is now refused.
• Fetch: robots.txt checks the resolved path (GHSA-f9hh-cmx9-2f23), so //private or /x/../private no longer slips past Disallow: /private.

Other changes worth knowing

• Per-directory read-only access. The filesystem server takes --read-only-dir to expose a directory for reading only.
• Everything server binds to loopback. Its HTTP transports now listen on loopback by default; set HOST to widen them. A setup that reached it from another machine needs that variable.
• Docker images run as non-root. Every server image now uses its non-root user, which can break a mounted volume owned by root. The memory server README has new Docker upgrade steps.
• Windows path checks. The filesystem server refuses NTFS alternate-data-stream paths, device names, and trailing dots or spaces.
• Fetch caps response size while reading the body, and git_log requires max_count of at least 1.
• Every tool input property now has a description, which helps models pick the right arguments.

Questions

Do I need to upgrade if I only use the memory or time server? No security advisory touches them in this release. The memory server's 2.1.1 fixes a lock heartbeat bug, so it is still worth taking.

Is the filesystem server safe on Windows now? Safer, not closed. The release says the read race and the earlier write race are only narrowed on Windows, and directory junctions are not yet covered in the git server.

Why does npm not show 2.3.0 as an update? Because older date versions such as 2026.8.31 sort higher than 2.3.0. Pin the version explicitly.

More on the MCP servers hub, the earlier v2.1.0 security release and the MCP servers category. To compare the reference servers with GitHub's own, read GitHub MCP vs reference MCP servers.