• Uses @modelcontextprotocol/sdk 1.3.0 through 1.31.0, or @modelcontextprotocol/server 2.0.0 through 2.2.0 (or a patched version without maxToolInputElements set).
• MCP server is exposed over an HTTP transport (not stdio-only).
• Clients that are not fully trusted can reach the server over HTTP without being authenticated before requests reach the SDK.

Affected

@modelcontextprotocol/sdk >=1.3.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0

Fixed in

1.32.0 · 2.3.0

ID

GHSA-46jr-4wx8-v453

• Uses @modelcontextprotocol/sdk 1.10.0 through 1.30.0, or @modelcontextprotocol/server 2.0.0, @modelcontextprotocol/node 2.0.0, or @modelcontextprotocol/hono 2.0.0.
• MCP server is exposed over Streamable HTTP (not stdio-only).
• Clients that are not fully trusted can reach the server's HTTP endpoint.
• Requests are not authenticated by the application before reaching the SDK.

Affected

@modelcontextprotocol/sdk >=1.10.0 <1.30.1 · @modelcontextprotocol/server >=2.0.0 <2.1.0 · @modelcontextprotocol/node >=2.0.0 <2.1.0 · @modelcontextprotocol/hono >=2.0.0 <2.0.1

Fixed in

1.30.1 · 2.1.0 · 2.0.1

ID

GHSA-f897-62hf-6gxq

• Uses @modelcontextprotocol/sdk version 1.24.0 through 1.31.0 (not 2.x packages).
• Runs an MCP HTTP server.
• The HTTP server passes a taskStore to McpServer or Server (experimental tasks feature enabled).
• Multiple client sessions share one InMemoryTaskStore instance.

Affected

@modelcontextprotocol/sdk >=1.24.0 <1.32.0

Fixed in

1.32.0

ID

GHSA-22jm-h49p-29qw

Source summary

Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server. With no user interaction, the client would send it: - the refresh token and client secret stored from an earlier sign-in - the client secret or signed assertion configured on a bundled provider Am I affected? Yes, if both of these hold: - your application uses the SDK's OAuth client over HTTP, through a

Affected

@modelcontextprotocol/sdk >=1.12.0 <1.31.0 · @modelcontextprotocol/client >=2.0.0 <2.2.0

Fixed in

1.31.0 · 2.2.0

ID

GHSA-6qxp-vccf-f47h

• Uses @modelcontextprotocol/sdk 1.6.0 through 1.31.0, @modelcontextprotocol/server 2.0.0 through 2.2.0, @modelcontextprotocol/express 2.0.0 through 2.0.1, or @modelcontextprotocol/server-legacy 2.0.0 through 2.3.0.
• HTTP MCP server uses requireBearerAuth() or verifyBearerToken().
• The authorization server also issues tokens for other services.
• The project's verifyAccessToken() does not check the token's audience (aud) itself.

Affected

@modelcontextprotocol/sdk >=1.6.0 <1.32.0 · @modelcontextprotocol/server >=2.0.0 <2.3.0 · @modelcontextprotocol/express >=2.0.0 <2.0.2 · @modelcontextprotocol/server-legacy >=2.0.0 <2.3.1

Fixed in

1.32.0 · 2.3.0 · 2.0.2 · 2.3.1

ID

GHSA-rvq5-wwqv-78pq

• Uses @modelcontextprotocol/sdk through 1.31.0 or @modelcontextprotocol/client 2.0.0 through 2.2.0.
• Application uses StreamableHTTPClientTransport, SSEClientTransport, or the SDK's OAuth client functions such as auth() (not stdio-only).
• The MCP server or authorization server the client talks to redirects requests to another origin.
• Requests carry custom headers (e.g. X-API-Key in requestInit.headers), an mcp-session-id, or sensitive request bodies such as OAuth token requests.

Affected

@modelcontextprotocol/sdk <1.32.0 · @modelcontextprotocol/client >=2.0.0 <2.3.0

Fixed in

1.32.0 · 2.3.0

ID

GHSA-6prh-2h8m-c8cw