Am I affected by MCP TypeScript SDK: Experimental tasks were not tied to the session that created them? What should I do?

Question

The experimental tasks feature in the MCP TypeScript SDK did not check which session created a task.

Affected: @modelcontextprotocol/sdk 1.24.0 through 1.31.0. Fixed in: 1.32.0. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-111767-modelcontextprotocol-sdk

AgentArmorHQ team · Accepted Answer

**Am I affected?**
Affected: @modelcontextprotocol/sdk 1.24.0 through 1.31.0. Fixed in: 1.32.0.
- Check your version: run `npm ls @modelcontextprotocol/sdk`. Versions >= 1.24.0, < 1.32.0 of @modelcontextprotocol/sdk are affected.

**What to do now**
1. Upgrade to the fixed version: run `npm install @modelcontextprotocol/sdk@1.32.0` (first patched version 1.32.0).
2. Upgrade to @modelcontextprotocol/sdk 1.32.0 or later.
3. If you cannot upgrade yet, remove taskStore, or create one InMemoryTaskStore per session.
4. Stop using the experimental tasks feature.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- GitHub Advisory Database: https://github.com/advisories/GHSA-22jm-h49p-29qw

Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-111767-modelcontextprotocol-sdk

Am I affected by MCP TypeScript SDK: Experimental tasks were not tied to the session that created them? What should I do?

1 answer

Add your answer or comment