GitHub Advisoryadvisory · npm

GHSA-w2fm-25vw-vh7f mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

HIGH Published 2026-04-01 Modified 2026-04-01 Official page ↗
Ecosystem
npm
Packages
mcp-handler
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-1395, CWE-362
Reviewed
2026-04-01

Affected packages

• npm mcp-handler: < 1.1.0 → fixed in 1.1.0

Description

`mcp-handler` versions prior to 1.1.0 accepted `@modelcontextprotocol/sdk` =1.26.0`, which contains the fix for CVE-2026-25536. Workarounds • Upgrade `@modelcontextprotocol/sdk` to `>=1.26.0` (note: the SDK will throw on transport reuse, which will break `mcp-handler` < 1.1.0 which effectively forces the upgrade) • Alternatively, manually create fresh `McpServer` and transport instances per request in your handler code

Related

Weakness · CWE (2)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References