8.6
High
CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
Description
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| typescript-sdk 1.24 | 1.24.0 → < 1.32.0 | 1.32.0 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of typescript-sdk
The 8 CVEs of typescript-sdk →
CVE-2026-111770
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
7.7
High
CVE-2026-111768
Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
7.5
High
CVE-2026-111769
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
Medium
CVE-2026-111771
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
Medium