Skip to content
Security
فارسی
Sign in / Register
Vulnerabilities
Products
Plugins
All products
@modelcontextprotocol/sdk
npm
· Package
9 reports
Vulnerability alerts
Follow
Package, identifier or title
Search
Severity
All
Critical
High
Medium
Low
Unknown
Fix status
All
Fix reported
No fix reported
Sort by
Recently updated
Highest severity
Report
Product
Ecosystem
Severity
Fix status
Last updated
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
CVE-2026-111769 · GHSA-6PRH-2H8M-C8CW
@modelcontextprotocol/client
@modelcontextprotocol/sdk
npm
Medium
Fix reported
2026-11-04
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
GHSA-F897-62HF-6GXQ
@modelcontextprotocol/hono
@modelcontextprotocol/node
npm
High
Fix reported
2026-10-27
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
CVE-2026-111768 · GHSA-46JR-4WX8-V453
@modelcontextprotocol/sdk
@modelcontextprotocol/server
npm
High
Fix reported
2026-10-20
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
CVE-2026-111771 · GHSA-RVQ5-WWQV-78PQ
@modelcontextprotocol/express
@modelcontextprotocol/sdk
npm
Medium
Fix reported
2026-10-20
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
CVE-2026-111767 · GHSA-22JM-H49P-29QW
@modelcontextprotocol/sdk
Red Hat Ansible Automation Platform 2/ansible-automation-platform-27/mcp-server-rhel9
npm
Red Hat
High
Fix reported
2026-10-20
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
CVE-2026-104850 · GHSA-6QXP-VCCF-F47H
@modelcontextprotocol/client
@modelcontextprotocol/sdk
npm
Red Hat
High
Fix reported
2026-10-06
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
CVE-2026-0621 · GHSA-8R9Q-7V3J-JR4G
@modelcontextprotocol/sdk
npm
High
Fix reported
2026-09-10
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
CVE-2026-25536 · GHSA-345P-7CG4-V4C7
@modelcontextprotocol/sdk
npm
High
Fix reported
2026-09-10
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
CVE-2025-66414 · GHSA-W48Q-CV73-MX4W
@modelcontextprotocol/sdk
npm
High
Fix reported
2026-09-10
