@modelcontextprotocol typescript-sdk

• CVE-2026-111770 High 7.7 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another 0.4%
• CVE-2026-111768 High 7.5 Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation 0.6%
• CVE-2026-111769 Medium 6.5 Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies 0.4%
• CVE-2026-111771 Medium 6.8 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service 0.5%
• CVE-2026-111767 High 8.6 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them 0.3%
• CVE-2026-104850 High 7.5 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server 0.2%
• CVE-2026-25536 High 7.1 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse 0.3%
• CVE-2025-66414 High 7.6 DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost 0.5%