MCP TypeScript SDK vulnerabilities and CVEs
The Beam CVE database tracks 8 security advisories for MCP TypeScript SDK: 6 high and 2 medium severity. The newest is CVE-2026-111767, published Oct 20, 2026 and fixed in 1.32.0.
The official TypeScript SDK for building MCP servers and clients.
Check your version: npm ls @modelcontextprotocol/sdk
- Vulnerabilities tracked
- 8
- Critical
- 0
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 5
All entries, newest first
CVE-2026-111767
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
high8.6Oct 20, 2026CVE-2026-111768
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
high7.5Oct 20, 2026CVE-2026-111769
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
medium6.5Oct 20, 2026CVE-2026-111771
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
medium6.8Oct 20, 2026CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
high7.5Oct 6, 2026CVE-2026-25536
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
high7.1Feb 4, 2026CVE-2026-0621
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
high8.7Jan 5, 2026CVE-2025-66414
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
high7.6Dec 2, 2025