ROOT-APP-NPM-CVE-2026-111767 CVE-2026-111767 in @modelcontextprotocol/sdk - Patched by Root

Root has patched CVE-2026-111767 in the @modelcontextprotocol/sdk package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-104850 CVE-2026-104850 in @modelcontextprotocol/sdk - Patched by Root

Root has patched CVE-2026-104850 in the @modelcontextprotocol/sdk package for Root:npm. Multiple fixed versions available...

CLSA-2026-1793125609 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.29.0-tuxcare.5...

CLSA-2026-1793110244 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.29.0-tuxcare.4...

CLSA-2026-1793110107 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.30.0-tuxcare.3...

CLSA-2026-1793102531 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.26.0-tuxcare.3...

CLSA-2026-1793102412 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.29.0-tuxcare.3...

CLSA-2026-1793100046 TuxCare security update for @modelcontextprotocol/sdk (2 CVEs)

TuxCare rebuilt @modelcontextprotocol/sdk to address 2 CVEs. Fixed in 1.26.0-tuxcare.2...

CLSA-2026-1793100011 TuxCare security update for @modelcontextprotocol/sdk (3 CVEs)

TuxCare rebuilt @modelcontextprotocol/sdk to address 3 CVEs. Fixed in 1.30.0-tuxcare.2...

CLSA-2026-1793097252 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.29.0-tuxcare.2...

CLSA-2026-1792574765 TuxCare security update for @modelcontextprotocol/sdk (2 CVEs)

TuxCare rebuilt @modelcontextprotocol/sdk to address 2 CVEs. Fixed in 1.30.1-tuxcare.2...

CVE-2026-111767

A flaw was found in the Model Context Protocol MCP TypeScript SDK @modelcontextprotocol/sdk. The experimental task storage feature taskStore does not verify which client session created a given task when multiple clients share a task store. A remote attacker sharing the same server instance can...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +6884 more potentially affected by CVE-2026-111768 via @modelcontextprotocol/sdk (>=1.3.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =1.0.0, =1.0.3 - @2345mfe/ocform-v3-mcp 1.0.0 and more Source cves: CVE-2026-111768 Source advisory: MEND:CVE-2026-111768...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +6814 more potentially affected by CVE-2026-111771 via @modelcontextprotocol/sdk (>=1.6.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.6.0, =0.3.3, =1.0.0, =0.1.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =1.0.0, =1.0.3 - @2345mfe/ocform-v3-mcp 1.0.0 and more Source cves: CVE-2026-111771 Source advisory: MEND:CVE-2026-111771...

0xgasless-mcp (>=1.0.3, <=1.0.5), 12306-adk-mcp (0.3.4) +11760 more potentially affected by CVE-2026-111769 via @modelcontextprotocol/sdk (>=0.4.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =0.4.0, =1.0.3, =0.3.3, =1.0.0, =0.1.0, =0.2.0, =0.0.1-beta.0, =0.1.0, =1.14.1, =1.0.0, =0.0.1, =1.0.0, =0.1.0, =0.1.3, =0.1.0, =0.1.9 and more Source cves: CVE-2026-111769 Source advisory: MEND:CVE-2026-111769...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +6884 more potentially affected by CVE-2026-111768 via @modelcontextprotocol/sdk (>=1.3.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =1.0.0, =1.0.3 - @2345mfe/ocform-v3-mcp 1.0.0 and more Source cves: CVE-2026-111768 Source advisory: OSV:GHSA-46JR-4WX8-V453...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +6884 more potentially affected by CVE-2026-111768 via @modelcontextprotocol/sdk (>=1.3.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =1.0.0, =1.0.3 - @2345mfe/ocform-v3-mcp 1.0.0 and more Source cves: CVE-2026-111768 Source advisory: GHSA-46JR-4WX8-V453...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +6884 more potentially affected by CVE-2026-111768 via @modelcontextprotocol/sdk (>=1.3.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =1.0.0, =1.0.3 - @2345mfe/ocform-v3-mcp 1.0.0 and more Source cves: CVE-2026-111768 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-21460687...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the tools/call request handler in mcp.ts, where an attacker can send a tools/call request with ...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +6814 more potentially affected by CVE-2026-111771 via @modelcontextprotocol/sdk (>=1.6.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.6.0, =0.3.3, =1.0.0, =0.1.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =1.0.0, =1.0.3 - @2345mfe/ocform-v3-mcp 1.0.0 and more Source cves: CVE-2026-111771 Source advisory: OSV:GHSA-RVQ5-WWQV-78PQ...