CVE-2026-111770

The @modelcontextprotocol/server TypeScript SDK (versions 2.0.0 through 2.2.0 ) contains a race condition where shared stateless HTTP transports or server instances can deliver messages to the wrong clients. This occurs because messages are matched using only the JSON-RPC request identifier , and...

CVE-2026-111770 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients...