Known vulnerabilities in @modelcontextprotocol server
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-111770 | Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another | 7.7 High | Nov 5, 2026 |
| CVE-2026-111768 | Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation | 7.5 High | Nov 5, 2026 |
| CVE-2026-111771 | Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service | 6.8 Medium | Nov 5, 2026 |