CVE-2026-111770

In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one "McpServer" or "Server" instance. Messages were matched to a connection by JSON-RPC "id" alone. SDK...