CVE-2026-111770: MCP TypeScript server SDK 2.x could send one HTTP client's responses to another client
In @modelcontextprotocol/server 2.0.0 through 2.2.0, an MCP server reached over HTTP could deliver one client's responses and notifications to a different client when clients shared one stateless transport or one McpServer instance. Messages were matched by JSON-RPC id alone, and SDK clients number requests from 0, so ids collide in normal use. Fixed in 2.3.0, but you also have to change your code.
What it is
If your server creates the transport or the McpServer once at startup and more than one client can reach the HTTP endpoint, responses are routed by JSON-RPC id only. Two clients that both send request id 0 can get each other's results, including tool output and data meant for the other user.
Until this release, the README examples for the @modelcontextprotocol/hono, express, fastify and node packages showed exactly that shared pattern, so many servers built from the examples are affected.
Not affected: createMcpHandler() with a factory that builds a new server on every call, stdio servers, and @modelcontextprotocol/sdk 1.26.0 and later.
Version 2.3.0 refuses to be shared: a second connect() rejects with ALREADY_CONNECTED and a stateless transport rejects its second request, so an affected app starts failing requests after the upgrade until its code is changed.
How to check
- Affected: @modelcontextprotocol/server (npm) 2.0.0 through 2.2.0.
- You are at risk if your MCP server runs over HTTP, serves more than one client, and builds the transport or McpServer once instead of per request or per session.
How to fix
- Upgrade @modelcontextprotocol/server to 2.3.0 or later.
- Then change the code: pass createMcpHandler() a factory that builds a new McpServer on every call, build a new McpServer and transport inside each request handler, or set sessionIdGenerator and keep one server and transport per session.
npm ls @modelcontextprotocol/serverSources
- criticalCVE-2026-114612: LiteLLM proxy lets an internal user forge an admin token and run commands
- criticalMalicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claude
- criticalCVE-2026-114125: A malicious website can tamper with your project through a running Storybook dev server
- criticalCVE-2026-102503: Google Agent Mesh let any peer call MCP backends through an unchecked ingress