GHSA-JM63-CQ47-J5JP MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another

Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one McpServer or Server instance. Messages were matched to a connection by JSON-RPC id alone. SDK...

MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another

Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one McpServer or Server instance. Messages were matched to a connection by JSON-RPC id alone. SDK...