CVE-2026-111770

A flaw was found in @modelcontextprotocol/server. When a Model Context Protocol MCP server handling HTTP traffic reuses a single server or transport instance across multiple connections, messages are matched solely using request identifiers that frequently collide. A remote client can trigger or...

ROOT-APP-NPM-GHSA-F897-62HF-6GXQ GHSA-f897-62hf-6gxq in @modelcontextprotocol/sdk - Patched by Root

Root has patched GHSA-f897-62hf-6gxq in the @modelcontextprotocol/sdk package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-111770 CVE-2026-111770 in @modelcontextprotocol/server - Patched by Root

Root has patched CVE-2026-111770 in the @modelcontextprotocol/server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-111768 CVE-2026-111768 in @modelcontextprotocol/server - Patched by Root

Root has patched CVE-2026-111768 in the @modelcontextprotocol/server package for Root:npm. Multiple fixed versions available...

CLSA-2026-1793269115 TuxCare security update for @modelcontextprotocol/client (1 CVE)

TuxCare rebuilt @modelcontextprotocol/client to address 1 CVE. Fixed in 2.0.0-tuxcare.3...

ROOT-APP-NPM-CVE-2026-104850 CVE-2026-104850 in @modelcontextprotocol/sdk - Patched by Root

Root has patched CVE-2026-104850 in the @modelcontextprotocol/sdk package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-111767 CVE-2026-111767 in @modelcontextprotocol/sdk - Patched by Root

Root has patched CVE-2026-111767 in the @modelcontextprotocol/sdk package for Root:npm. Multiple fixed versions available...

CLSA-2026-1793207764 TuxCare security update for @modelcontextprotocol/client (1 CVE)

TuxCare rebuilt @modelcontextprotocol/client to address 1 CVE. Fixed in 2.0.0-tuxcare.1...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +6103 more potentially affected by unknown CVE via @modelcontextprotocol/sdk (>=1.10.0, <=1.30.0)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =1.0.0, =1.2.1, =1.2.7 and more Source cves: unknown CVE Source advisory: GHSA-F897-62HF-6GXQ...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +6103 more potentially affected by unknown CVE via @modelcontextprotocol/sdk (>=1.10.0, <=1.30.0)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =1.0.0, =1.2.1, =1.2.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F897-62HF-6GXQ...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1028 more potentially affected by unknown CVE via @modelcontextprotocol/server (2.0.0)

@modelcontextprotocol/server NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server and may be impacted: - @0pvalencia/academic-linter-mcp =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0,...

@lorepack/cli (0.1.0-alpha.0), @mgcrea/mcp-reddit (>=0.1.0, <=0.1.1) +8 more potentially affected by unknown CVE via @modelcontextprotocol/hono (2.0.0)

@modelcontextprotocol/hono NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/hono and may be impacted: - @lorepack/cli 0.1.0-alpha.0 - @mgcrea/mcp-reddit =0.1.0, =1.37.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0,...

@1mcp/agent (>=0.38.0, <=0.39.0-beta.3), @3ngram/server (>=1.1.0, <=1.8.5) +279 more potentially affected by unknown CVE via @modelcontextprotocol/node (2.0.0)

@modelcontextprotocol/node NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/node and may be impacted: - @1mcp/agent =0.38.0, =1.1.0, =0.2.0, =0.1.8-beta.0, =13.0.0-rc.4, =0.1.0, =0.2.1, =0.1.0, =1.0.0, =0.2.2,...

@lorepack/cli (0.1.0-alpha.0), @mgcrea/mcp-reddit (>=0.1.0, <=0.1.1) +8 more potentially affected by unknown CVE via @modelcontextprotocol/hono (2.0.0)

@modelcontextprotocol/hono NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/hono and may be impacted: - @lorepack/cli 0.1.0-alpha.0 - @mgcrea/mcp-reddit =0.1.0, =1.37.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0,...

@lorepack/cli (0.1.0-alpha.0), @mgcrea/mcp-reddit (>=0.1.0, <=0.1.1) +8 more potentially affected by unknown CVE via @modelcontextprotocol/hono (2.0.0)

@modelcontextprotocol/hono NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/hono and may be impacted: - @lorepack/cli 0.1.0-alpha.0 - @mgcrea/mcp-reddit =0.1.0, =1.37.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0,...

@1mcp/agent (>=0.38.0, <=0.39.0-beta.3), @3ngram/server (>=1.1.0, <=1.8.5) +279 more potentially affected by unknown CVE via @modelcontextprotocol/node (2.0.0)

@modelcontextprotocol/node NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/node and may be impacted: - @1mcp/agent =0.38.0, =1.1.0, =0.2.0, =0.1.8-beta.0, =13.0.0-rc.4, =0.1.0, =0.2.1, =0.1.0, =1.0.0, =0.2.2,...

@1mcp/agent (>=0.38.0, <=0.39.0-beta.3), @3ngram/server (>=1.1.0, <=1.8.5) +279 more potentially affected by unknown CVE via @modelcontextprotocol/node (2.0.0)

@modelcontextprotocol/node NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/node and may be impacted: - @1mcp/agent =0.38.0, =1.1.0, =0.2.0, =0.1.8-beta.0, =13.0.0-rc.4, =0.1.0, =0.2.1, =0.1.0, =1.0.0, =0.2.2,...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/hono is a Hono adapters for the Model Context Protocol TypeScript server SDK - Hono middleware Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1028 more potentially affected by unknown CVE via @modelcontextprotocol/server (2.0.0)

@modelcontextprotocol/server NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server and may be impacted: - @0pvalencia/academic-linter-mcp =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0,...