What’s Vulnerable › Products

modelcontextprotocol typescript-sdk vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your modelcontextprotocol typescript-sdk version is affected

Latest modelcontextprotocol typescript-sdk vulnerabilities

• CVE-2026-111767 — MCP TypeScript SDK: Experimental tasks were not tied to the session that created them (CVSS 8.6)
• CVE-2026-104850 — MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (CVSS 7.5)
• CVE-2026-25536 — @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse (CVSS 7.1)
• CVE-2026-0621 — MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS (CVSS 7.5)
• CVE-2025-66414 — DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost (CVSS 8.1)