Known vulnerabilities in @modelcontextprotocol express
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-111771 | Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service | 6.8 Medium | Nov 5, 2026 |