@modelcontextprotocol sdk

• CVE-2026-111768 High 7.5 Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation 0.6%
• CVE-2026-111769 Medium 6.5 Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies 0.4%
• CVE-2026-111771 Medium 6.8 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service 0.5%