Description (CNA)
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| modelcontextprotocol / typescript-sdk | affected >= 1.10.0, < 1.26.0 |
CWE
CWE-362
References
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7
- https://github.com/modelcontextprotocol/typescript-sdk/issues/204
- https://github.com/modelcontextprotocol/typescript-sdk/issues/243
ADP enrichment
No English description supplied.
No references supplied.
A data leak by way of a race condition has been discovered in the @modelcontextprotocol/sdk npm library. The cross-client response data leak exists when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. When two or more MCP clients send requests concurrently through a shared server instance, JSON-RPC message ID collisions cause responses to be routed to the wrong client's HTTP connection. Client A can receive response data intended for Client B, and vice versa, even when authorization was correctly enforced on each individual request.