{"action":"Upgrade @modelcontextprotocol/sdk to 1.32.0 or later.","affected":[{"fixed":"1.32.0","introduced":"0"}],"component":"@modelcontextprotocol/sdk","cve_ids":["CVE-2026-111769"],"ecosystem":"npm","exploited":false,"fixed_versions":["1.32.0"],"ghsa_id":"GHSA-6prh-2h8m-c8cw","id":"tcs_01M5JK8JZNSJSRDT3YT9M7R4F8","modified_at":"2026-10-20T18:45:09.465104395Z","published_at":"2026-10-20T18:26:30Z","references":["https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2901","https://github.com/modelcontextprotocol/typescript-sdk/pull/2902","https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d","https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0","https://github.com/modelcontextprotocol/typescript-sdk"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-6prh-2h8m-c8cw","url":"https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw"}],"summary":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies"}