Skip to content
OpenAdvisories

Package · npm

mcp-handler

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.1
    GHSA-w2fm-25vw-vh7f

    mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

    `mcp-handler` versions prior to 1.1.0 accepted `@modelcontextprotocol/sdk` < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [[CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536)] that causes concurrent requests from differ…

    mcp-handler npm