[GHSA-8r9q-7v3j-jr4g] Correct affected version range for CVE-2026-0621

[albertabiev1]

Summary

The current advisory lists the affected version range as "introduced": "0" (all versions), which incorrectly flags versions of @modelcontextprotocol/sdk that do not contain the vulnerable code.

This PR changes the affected range from >= 0, < 1.25.2 to >= 1.3.0, < 1.25.2.

Evidence

The vulnerable UriTemplate class (specifically the partToRegExp() method containing the ReDoS-prone regex ([^/]+(?:,[^/]+)*)) was first introduced in commit 7f0cf730 ("URI Template parser and matcher"), which first shipped in version 1.3.0. The file src/shared/uriTemplate.ts does not exist in any earlier version.

Verified not affected (file src/shared/uriTemplate.ts absent, no URI template matching logic):

• 0.0.23
• 0.7.0
• 1.0.3
• 1.2.0

Verified affected (file present, vulnerable regex confirmed with ReDoS PoC):

• 1.10.0
• 1.25.1

References

• Commit introducing UriTemplate: 7f0cf730
• Fix commit: b392f02f
• Fix PR (v1.x backport): #1365
• Vendor advisory: GHSA-cqwc-fm46-7fff