Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-25536
7.1
HIGHCVSS v3
Published
February 4, 2026
Affected
2 projects
Assigned by
GitHub
Severity scale
010
Description
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
@modelcontextprotocol/sdk
NPMModel Context Protocol implementation for TypeScript
NPMModel Context Protocol implementation for TypeScript>= 1.10.0, < 1.26.0OSV
modelcontextprotocol/typescript-sdk
GitHubThe official TypeScript SDK for Model Context Protocol servers and clients
GitHubThe official TypeScript SDK for Model Context Protocol servers and clientsNVD