Skip to content
OpenAdvisories

Product · modelcontextprotocol

typescript-sdk

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.7
    CVE-2026-111770 Public exploit

    Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

    The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Se…

    modelcontextprotocol typescript-sdk server @modelcontextprotocol/server npm
  • High 7.5
    CVE-2026-111768

    Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

    The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did no…

    modelcontextprotocol typescript-sdk server sdk npm
  • High 8.6
    CVE-2026-111767

    MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemory…

    modelcontextprotocol typescript-sdk @modelcontextprotocol/sdk npm
  • High 7.5
    CVE-2026-104850 Public exploit

    MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authoriza…

    modelcontextprotocol typescript-sdk @modelcontextprotocol/sdk @modelcontextprotocol/client npm
  • High 7.1
    CVE-2026-25536

    @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections…

    modelcontextprotocol typescript-sdk @modelcontextprotocol/sdk npm
  • High 7.6
    CVE-2025-66414

    DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based M…

    modelcontextprotocol typescript-sdk @modelcontextprotocol/sdk npm