7.1
High
CVE-2026-25536 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
Description
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| typescript-sdk 1.10 | 1.10.0 → < 1.26.0 | 1.26.0 |
| Red Hat Ansible Automation Platform 2.6 1772196222 | earliest → < 1772196222 | 1772196222 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of typescript-sdk
The 8 CVEs of typescript-sdk →
CVE-2026-111770
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
7.7
High
CVE-2026-111768
Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
7.5
High
CVE-2026-111769
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
Medium
CVE-2026-111771
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
Medium