@modelcontextprotocol/server has 4 advisories. Version not read yet.

npm ↗

Versions

Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.

2.x
safe 2.3.0
AffectedSafe

Details

You run
not in lockfile
Safe
2.3.0 · 2.1.0
Advisories
4 in 120 days

Used by

Stacks that pull this package.

Not part of a tracked stack.

Alerts(4)

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

@modelcontextprotocol/sdk · 15 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/sdk 1.3.0 through 1.31.0, or @modelcontextprotocol/server 2.0.0 through 2.2.0 (or a patched version without maxToolInputElements set).
  • MCP server is exposed over an HTTP transport (not stdio-only).
  • Clients that are not fully trusted can reach the server over HTTP without being authenticated before requests reach the SDK.
Affected
@modelcontextprotocol/sdk >=1.3.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0
Fixed in
1.32.0 · 2.3.0
ID
GHSA-46jr-4wx8-v453
Open the alert

Shared transport or server instances delivered one HTTP client's messages to another

@modelcontextprotocol/server · 15 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/server version 2.0.0 through 2.2.0.
  • MCP server is reached over HTTP (not stdio).
  • More than one client can reach the HTTP endpoint.
  • Code creates the transport or the McpServer/Server instance once at startup and shares it across clients, instead of once per request or per session.
Affected
@modelcontextprotocol/server >=2.0.0 <2.3.0
Fixed in
2.3.0
ID
GHSA-jm63-cq47-j5jp
Open the alert

HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

@modelcontextprotocol/sdk · 15 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/sdk 1.10.0 through 1.30.0, or @modelcontextprotocol/server 2.0.0, @modelcontextprotocol/node 2.0.0, or @modelcontextprotocol/hono 2.0.0.
  • MCP server is exposed over Streamable HTTP (not stdio-only).
  • Clients that are not fully trusted can reach the server's HTTP endpoint.
  • Requests are not authenticated by the application before reaching the SDK.
Affected
@modelcontextprotocol/sdk >=1.10.0 <1.30.1 · @modelcontextprotocol/server >=2.0.0 <2.1.0 · @modelcontextprotocol/node >=2.0.0 <2.1.0 · @modelcontextprotocol/hono >=2.0.0 <2.0.1
Fixed in
1.30.1 · 2.1.0 · 2.0.1
ID
GHSA-f897-62hf-6gxq
Open the alert

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

@modelcontextprotocol/sdk · 5 Oct

Medium
Conditions not read yet

Source summary

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I affected? Yes, if your HTTP server uses requireBearerAuth() or verifyBearerToken() , its authorization server also issues tokens for other services, and your verifyAccessToken() does not check the token's audience ( aud ) itself. Affected versions: - @modelcontextprotocol/sdk 1.6.0 through 1.31.0 - @model

Affected
@modelcontextprotocol/sdk >=1.6.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0 · @modelcontextprotocol/express >=2.0.0 <2.0.2 · @modelcontextprotocol/server-legacy >=2.0.0 <2.3.1
Fixed in
1.32.0 · 2.3.0 · 2.0.2 · 2.3.1
ID
GHSA-rvq5-wwqv-78pq
Open the alert