modelcontextprotocol express vulnerabilities

Latest modelcontextprotocol express CVEs

Newest publication first

1. CVE-2026-111771 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service

   Published 2026-11-05

   Medium·CVSS 6.8 EPSS 0.54%

   The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprot...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.