Model Context Protocol TypeScript SDK: Cross-client message leakage (CVE-2026-111770)

The MCP TypeScript SDK is vulnerable to cross-client message leakage when implemented as a shared, stateless instance. Because the protocol identifies messages by JSON-RPC IDs, which typically reset at 0 for every client, concurrent requests reaching a shared McpServer or transport instance result in ID collisions. In this state, an MCP server may erroneously return one client's responses or push notifications to another client sharing the same instance. This behavior was unintentionally encouraged by early SDK documentation, which provided examples using globally initialized server instances in common Node.js frameworks like Hono, Express, and Fastify. The vulnerability affects @modelcontextprotocol/server versions 2.0.0 through 2.2.0. Successful exploitation allows for sensitive information disclosure between authorized clients interacting with the same MCP server instance.

Impact

Successful exploitation results in unauthorized data access where clients receive responses or notifications intended for other users. This impacts any multi-user environment where a single MCP server is exposed via HTTP and initialized as a singleton. Organizations relying on this SDK for integrating LLM tools or internal automation are at risk of cross-session data leakage.

Recommendation

1. Upgrade the @modelcontextprotocol/server package to version 2.3.0 or later to ensure the SDK actively enforces connection isolation and rejects attempts to share instances.
2. Audit all existing MCP server implementations for the singleton pattern; refactor code to instantiate McpServer and transport objects either per-request or per-session using a sessionIdGenerator.
3. Validate implementation patterns against the official SDK update guidance to ensure session-specific state management is strictly applied.