CVE-2026-111770

A flaw was found in @modelcontextprotocol/server. When a Model Context Protocol MCP server handling HTTP traffic reuses a single server or transport instance across multiple connections, messages are matched solely using request identifiers that frequently collide. A remote client can trigger or...