Skip to content
OpenAdvisories

Package · npm

@modelcontextprotocol/server

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.7
    CVE-2026-111770 Public exploit

    Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

    The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Se…

    modelcontextprotocol typescript-sdk server @modelcontextprotocol/server npm
  • High 7.5
    CVE-2026-111768

    Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

    The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did no…

    modelcontextprotocol typescript-sdk server sdk npm
  • High 7.5
    GHSA-f897-62hf-6gxq

    MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

    ### Summary In affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the number of messages in a JSON-RPC batch. Large requests could exhaust the server's memory, and one long batch could block it from serving anyone…

    @modelcontextprotocol/sdk @modelcontextprotocol/server @modelcontextprotocol/hono @modelcontextprotocol/node npm