npm/@modelcontextprotocol/sdk CVE-2026-111767: high 8.6
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
Action: Upgrade @modelcontextprotocol/sdk to 1.32.0 or later.
npm i @modelcontextprotocol/sdk@1.32.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.24.0 | 1.32.0 | - |
Fixed versions
| 1.32.0 |
Sources
- osv: GHSA-22jm-h49p-29qw
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2925
- https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa
- https://github.com/modelcontextprotocol/typescript-sdk
CVE-2026-111767 · published · modified · JSON