CVE-2026-25536

npm/@modelcontextprotocol/sdk CVE-2026-25536: high 7.1, EPSS 0.38%

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Action: Upgrade @modelcontextprotocol/sdk to 1.26.0 or later.

npm i @modelcontextprotocol/sdk@1.26.0

Affected

Fixed versions

Sources

• osv: GHSA-345p-7cg4-v4c7
• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7
• https://nvd.nist.gov/vuln/detail/CVE-2026-25536
• https://github.com/modelcontextprotocol/typescript-sdk/issues/204
• https://github.com/modelcontextprotocol/typescript-sdk/issues/243
• https://github.com/modelcontextprotocol/typescript-sdk

CVE-2026-25536 · published 2026-02-04T20:04:16Z · modified 2026-09-10T03:50:33.823318085Z · JSON