modelcontextprotocol typescript-sdk vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20267

Newest CVEs

• CVE-2026-111770

  Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

  modelcontextprotocol · typescript-sdk

  High7.7
• CVE-2026-111768

  Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

  modelcontextprotocol · typescript-sdk

  High7.5
• CVE-2026-111769

  Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

  modelcontextprotocol · typescript-sdk

  Medium6.5
• CVE-2026-111771

  Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service

  modelcontextprotocol · typescript-sdk

  Medium6.8
• CVE-2026-111767

  MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

  modelcontextprotocol · typescript-sdk

  High8.6
• CVE-2026-104850

  MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

  modelcontextprotocol · typescript-sdk

  High7.5
• CVE-2026-25536

  @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

  modelcontextprotocol · typescript-sdk

  High7.1
• CVE-2025-66414

  DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

  modelcontextprotocol · typescript-sdk

  High7.6