7.1
Élevée
CVE-2026-25536 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
Description
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| typescript-sdk 1.10 | 1.10.0 → < 1.26.0 | 1.26.0 |
| Red Hat Ansible Automation Platform 2.6 1772196222 | premières → < 1772196222 | 1772196222 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de typescript-sdk
Les 8 CVE de typescript-sdk →
CVE-2026-111770
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
7.7
Élevée
CVE-2026-111768
Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
7.5
Élevée
CVE-2026-111769
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
Moyenne
CVE-2026-111771
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
Moyenne