While the official server does have the fix installed the latest (v1.6.10) client and server download on curseforge does not, this is not ok at all as someone might still want to download and host his own server or might join another non official server that is still vulnerable.
A new release needs to be made on the CurseForge page to include the fix mod created.
See this and this for more info.

I will see what I can do. The pack is pretty old and not really maintained anymore. However, I don't think it would be to hard to do this.