@modelcontextprotocol/express has 1 advisory. Version not read yet.

npm

Versions

Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.

2.x
safe 2.0.2
AffectedSafe

Details

You run
not in lockfile
Safe
2.0.2
Advisories
1 in 120 days

Used by

Stacks that pull this package.

Not part of a tracked stack.

Alerts(1)

Server bearer authentication accepted tokens issued for another service

@modelcontextprotocol/sdk · 5 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/sdk 1.6.0 through 1.31.0, @modelcontextprotocol/server 2.0.0 through 2.2.0, @modelcontextprotocol/express 2.0.0 through 2.0.1, or @modelcontextprotocol/server-legacy 2.0.0 through 2.3.0.
  • HTTP MCP server uses requireBearerAuth() or verifyBearerToken().
  • The authorization server also issues tokens for other services.
  • The project's verifyAccessToken() does not check the token's audience (aud) itself.
Affected
@modelcontextprotocol/sdk >=1.6.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0 · @modelcontextprotocol/express >=2.0.0 <2.0.2 · @modelcontextprotocol/server-legacy >=2.0.0 <2.3.1
Fixed in
1.32.0 · 2.3.0 · 2.0.2 · 2.3.1
ID
GHSA-rvq5-wwqv-78pq
Open the alert