CVEvulnerability

CVE-2026-25536

7.1 HIGH Published 2026-02-04 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-02-04
Last modified
2026-07-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-362, CWE-367

Description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.

Affected configurations

• lfprojects mcp typescript sdk (>= 1.10.0 < 1.26.0)

Related

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References