cve.bz

CVE-2026-25536

7.1 highEPSS 0.3%

High (7.1) in lfprojects mcp typescript sdk. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in @modelcontextprotocol/sdk 1.26.0.

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.

Severity

CVSS 3.1

7.1 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWEs
CWE-362, CWE-367
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-345p-7cg4-v4c7npm@modelcontextprotocol/sdk>=1.10.0 <1.26.01.26.0

References

Check your stackJSON