Vulnerabilities

TI-2026-20645 CVE-2026-25536 · GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

LOW 31

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00293 Published 2026-02-04 Fixed in 1.26.0 CWE-362

TI-2026-00421 CVE-2026-0621 · GHSA-8r9q-7v3j-jr4g

MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

HIGH 77

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00438 Published 2026-01-05 Fixed in 1.25.2 CWE-1333

TI-2025-40850 CVE-2025-66414 · GHSA-w48q-cv73-mx4w

DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

LOW 36

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00544 Published 2025-12-02 Fixed in 1.24.0 CWE-1188

Vulnerabilities

Filters

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost