modelcontextprotocol/typescript-sdk Security Advisories | GitStock

high2026-10-20

MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another

GHSA-jm63-cq47-j5jp · CVE-2026-111770

high2026-10-20

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

GHSA-46jr-4wx8-v453 · CVE-2026-111768

medium2026-10-20

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

GHSA-rvq5-wwqv-78pq · CVE-2026-111771

high2026-10-20

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

GHSA-22jm-h49p-29qw · CVE-2026-111767

medium2026-10-20

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

GHSA-6prh-2h8m-c8cw · CVE-2026-111769

high2026-10-06

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

GHSA-6qxp-vccf-f47h · CVE-2026-104850

high2026-02-04

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

GHSA-345p-7cg4-v4c7 · CVE-2026-25536

high2026-01-05

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

GHSA-8r9q-7v3j-jr4g · CVE-2026-0621

high2025-12-02

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

GHSA-w48q-cv73-mx4w · CVE-2025-66414