CVE-2026-82456: Mcp Express Unbound Listenercve-2026-82456-mcp-express-unbound-listener
The Express application hosting Model Context Protocol (MCP) transports calls `app.listen()` without specifying an explicit host or bind address. In Express, omitting the host defaults to binding on all network interfaces (`0.0.0.0`), exposing MCP tools to any reachable network client. Explicitly bind to a loopback address (e.g., `127.0.0.1`) or enforce inbo
