@modelcontextprotocol/server-legacy has 1 advisory. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
Details
- You run
- not in lockfile
- Safe
- 2.3.1
- Advisories
- 1 in 120 days
Used by
Stacks that pull this package.
Not part of a tracked stack.
Alerts(1)
Source summary
Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I affected? Yes, if your HTTP server uses requireBearerAuth() or verifyBearerToken() , its authorization server also issues tokens for other services, and your verifyAccessToken() does not check the token's audience ( aud ) itself. Affected versions: - @modelcontextprotocol/sdk 1.6.0 through 1.31.0 - @model
- Affected
- @modelcontextprotocol/sdk >=1.6.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0 · @modelcontextprotocol/express >=2.0.0 <2.0.2 · @modelcontextprotocol/server-legacy >=2.0.0 <2.3.1
- Fixed in
- 1.32.0 · 2.3.0 · 2.0.2 · 2.3.1
- ID
- GHSA-rvq5-wwqv-78pq