npm/@modelcontextprotocol/server CVE-2026-111770: high 7.7
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
Action: Upgrade @modelcontextprotocol/server to 2.3.0 or later.
npm i @modelcontextprotocol/server@2.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.3.0 | - |
Fixed versions
| 2.3.0 |
Sources
- osv: GHSA-jm63-cq47-j5jp
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2918
- https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d
- https://github.com/modelcontextprotocol/typescript-sdk
CVE-2026-111770 · published · modified · JSON