HighGHSA-jm63-cq47-j5jpCVE-2026-11177015 Oct · 8 days ago
Source ↗

Shared transport or server instances delivered one HTTP client's messages to another.

Does it affect you?

0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

15 Oct
8 daysfrom publication to Patchwire
  1. Published by GitHub advisory15 Oct
  2. Seen by Patchwire23 Oct
  3. Fix released15 Oct
@modelcontextprotocol/server2.3.0

Versions of @modelcontextprotocol/server

2.x
safe 2.3.0
AffectedSafe

Packages

@modelcontextprotocol/server

Stacks

Not part of a tracked stack.

Related alerts(3)

Same packages

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

@modelcontextprotocol/sdk · 15 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/sdk 1.3.0 through 1.31.0, or @modelcontextprotocol/server 2.0.0 through 2.2.0 (or a patched version without maxToolInputElements set).
  • MCP server is exposed over an HTTP transport (not stdio-only).
  • Clients that are not fully trusted can reach the server over HTTP without being authenticated before requests reach the SDK.
Affected
@modelcontextprotocol/sdk >=1.3.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0
Fixed in
1.32.0 · 2.3.0
ID
GHSA-46jr-4wx8-v453
Open the alert

HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

@modelcontextprotocol/sdk · 15 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/sdk 1.10.0 through 1.30.0, or @modelcontextprotocol/server 2.0.0, @modelcontextprotocol/node 2.0.0, or @modelcontextprotocol/hono 2.0.0.
  • MCP server is exposed over Streamable HTTP (not stdio-only).
  • Clients that are not fully trusted can reach the server's HTTP endpoint.
  • Requests are not authenticated by the application before reaching the SDK.
Affected
@modelcontextprotocol/sdk >=1.10.0 <1.30.1 · @modelcontextprotocol/server >=2.0.0 <2.1.0 · @modelcontextprotocol/node >=2.0.0 <2.1.0 · @modelcontextprotocol/hono >=2.0.0 <2.0.1
Fixed in
1.30.1 · 2.1.0 · 2.0.1
ID
GHSA-f897-62hf-6gxq
Open the alert

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

@modelcontextprotocol/sdk · 5 Oct

Medium
Conditions not read yet

Source summary

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I affected? Yes, if your HTTP server uses requireBearerAuth() or verifyBearerToken() , its authorization server also issues tokens for other services, and your verifyAccessToken() does not check the token's audience ( aud ) itself. Affected versions: - @modelcontextprotocol/sdk 1.6.0 through 1.31.0 - @model

Affected
@modelcontextprotocol/sdk >=1.6.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0 · @modelcontextprotocol/express >=2.0.0 <2.0.2 · @modelcontextprotocol/server-legacy >=2.0.0 <2.3.1
Fixed in
1.32.0 · 2.3.0 · 2.0.2 · 2.3.1
ID
GHSA-rvq5-wwqv-78pq
Open the alert