CVE-2026-111770

The @modelcontextprotocol/server TypeScript SDK (versions 2.0.0 through 2.2.0 ) contains a race condition where shared stateless HTTP transports or server instances can deliver messages to the wrong clients. This occurs because messages are matched using only the JSON-RPC request identifier , and...