v0.76.2 v1.0.3
medium risk
mukul975/cve-mcp-serverSep 14, 2026 → Sep 15, 20261 day between releases
What's New
Upgraded Next.js to patch critical RCE and enforced strict token expiration and CSP policies.
Breaking Changes
- Access-code tokens now expire after 7 days
- Render service enforces stricter CSPs
- Audio provider validates every redirect hop
New Features
- Server owns the asset entry lifecycle
- Inquiry-based exercise-class teaching skill
Improvements
- Upgraded Next.js to patch critical RCE
- Access-code verification is now rate-limited
- Render service injects CSP to prevent untrusted HTML
- Audio provider validates redirect hops
Bug Fixes
- Fixed unauthenticated remote code execution vulnerability
- Fixed access-code token verification bypass
- Fixed untrusted HTML execution in render service
Upgrade Notes
Users relying on long-lived access codes must generate new ones as tokens now expire after 7 days. The render service CSP changes may affect custom preview configurations.
The Two Releases
v0.76.2
v0.76.2
Sep 14, 2026· 1 month ago
Minimal release notes: "**Full Changelog**: https://github.com/Mesh-LLM/mesh-llm/compare/v0.76.1...v0.76.2"
Full release notesv1.0.3
OpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
A security release addressing three advisories, upgrading Next.js to patch a critical RCE, and including bug fixes and features merged since 1.0.2.
Full release notes