Product

@Modelcontextprotocol/Server (>= 2.0.0, < 2.3.0)

1 brief RSS

Model Context Protocol TypeScript SDK: Cross-client message leakage (CVE-2026-111770)

A high-severity vulnerability in the MCP TypeScript SDK (CVE-2026-111770) allows an MCP server to misroute messages between clients due to JSON-RPC request ID collisions when server instances are incorrectly shared.

@modelcontextprotocol/server information-disclosure mcp sdk-vulnerability

1c 7h ago