modelcontextprotocol typescript-sdk vulnerabilities

Latest modelcontextprotocol typescript-sdk CVEs

Newest publication first

1. CVE-2026-111770 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

   Published 2026-11-05

   High·CVSS 7.7 EPSS 0.37%

   The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among m...

2. CVE-2026-111768 Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

   Published 2026-11-05

   High·CVSS 7.5 EPSS 0.60%

   The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on...

3. CVE-2026-111769 Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

   Published 2026-11-05

   Medium·CVSS 6.5 EPSS 0.40%

   The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requ...

4. CVE-2026-111771 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service

   Published 2026-11-05

   Medium·CVSS 6.8 EPSS 0.54%

   The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprot...

5. CVE-2026-111767 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

   Published 2026-10-20

   High·CVSS 8.6

   MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list,...

6. CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

   Published 2026-10-06

   High·CVSS 7.5 EPSS 0.28%

   MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received...

7. CVE-2026-25536 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

   Published 2026-02-04

   High·CVSS 7.1

   MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in st...

8. CVE-2025-66414 DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

   Published 2025-12-02

   High·CVSS 7.6

   MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on l...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.