npm/@modelcontextprotocol/sdk CVE-2026-104850: high 7.5, EPSS 0.23%
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Action: Upgrade @modelcontextprotocol/sdk to 1.31.0 or later.
npm i @modelcontextprotocol/sdk@1.31.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.12.0 | 1.31.0 | - |
Fixed versions
| 1.31.0 |
Sources
- osv: GHSA-6qxp-vccf-f47h
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2887
- https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd
- https://github.com/modelcontextprotocol/typescript-sdk
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0
CVE-2026-104850 · published · modified · JSON