CVE-2026-111770

A flaw was found in @modelcontextprotocol/server. When a Model Context Protocol MCP server handling HTTP traffic reuses a single server or transport instance across multiple connections, messages are matched solely using request identifiers that frequently collide. A remote client can trigger or...

CVE-2026-111768

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of arr...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111770 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111770 Source advisory: MEND:CVE-2026-111770...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111768 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111768 Source advisory: MEND:CVE-2026-111768...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111771 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111771 Source advisory: MEND:CVE-2026-111771...

@1mcp/agent (>=0.38.0, <=0.39.0-beta.3), @3ngram/server (>=1.1.0, <=1.8.5) +71 more potentially affected by CVE-2026-111771 via @modelcontextprotocol/server-legacy (>=2.0.0, <=2.1.0)

@modelcontextprotocol/server-legacy NPM version =2.0.0, =0.38.0, =1.1.0, =0.3.8, =0.5.0, =2.0.0, =0.59.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =3.1.0 and more Source cves: CVE-2026-111771 Source advisory: MEND:CVE-2026-111771...

ROOT-APP-NPM-CVE-2026-111770 CVE-2026-111770 in @modelcontextprotocol/server - Patched by Root

Root has patched CVE-2026-111770 in the @modelcontextprotocol/server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-111768 CVE-2026-111768 in @modelcontextprotocol/server - Patched by Root

Root has patched CVE-2026-111768 in the @modelcontextprotocol/server package for Root:npm. Multiple fixed versions available...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1034 more potentially affected by unknown CVE via @modelcontextprotocol/server (2.0.0)

@modelcontextprotocol/server NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server and may be impacted: - @0pvalencia/academic-linter-mcp =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0,...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1034 more potentially affected by unknown CVE via @modelcontextprotocol/server (2.0.0)

@modelcontextprotocol/server NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server and may be impacted: - @0pvalencia/academic-linter-mcp =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0,...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1034 more potentially affected by unknown CVE via @modelcontextprotocol/server (2.0.0)

@modelcontextprotocol/server NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server and may be impacted: - @0pvalencia/academic-linter-mcp =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0,...

Race Condition

Overview @modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package Affected versions of this package are vulnerable to Race Condition via transport instance reuse in streamableHttp.ts and createMcpHandler.ts, where a stateless transport or server...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111770 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111770 Source advisory: GHSA-JM63-CQ47-J5JP...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111770 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111770 Source advisory: OSV:GHSA-JM63-CQ47-J5JP...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111770 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111770 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSERVER-21691379...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111768 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111768 Source advisory: OSV:GHSA-46JR-4WX8-V453...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111768 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111768 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSERVER-21460686...

@0pvalencia/academic-linter-mcp (>=0.1.0, <=0.1.1), @0pvalencia/app-screenshot-mcp (>=0.1.0, <=0.1.1) +1296 more potentially affected by CVE-2026-111768 via @modelcontextprotocol/server (>=2.0.0, <=2.2.0)

@modelcontextprotocol/server NPM version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.38.0, =1.3.3, =1.1.0, =2026.925.1, =0.2.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-111768 Source advisory: GHSA-46JR-4WX8-V453...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the tools/call request handler in mcp.ts, where an attacker can send a...