{"action":"Upgrade @modelcontextprotocol/client to 2.3.0 or later.","affected":[{"fixed":"2.3.0","introduced":"2.0.0"}],"component":"@modelcontextprotocol/client","cve_ids":["CVE-2026-111769"],"ecosystem":"npm","exploited":false,"fixed_versions":["2.3.0"],"ghsa_id":"GHSA-6prh-2h8m-c8cw","id":"tcs_01M5KF7M3PF2QJQSJ6X2A4KXR6","modified_at":"2026-10-20T18:45:09.465104395Z","published_at":"2026-10-20T18:26:30Z","references":["https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2901","https://github.com/modelcontextprotocol/typescript-sdk/pull/2902","https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d","https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0","https://github.com/modelcontextprotocol/typescript-sdk"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-6prh-2h8m-c8cw#npm/@modelcontextprotocol/client","url":"https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw"}],"summary":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies"}