MCP TypeScript server SDK sent one HTTP client's messages to another
- Product
- @modelcontextprotocol/server (MCP TypeScript server SDK)
- CVE
- CVE-2026-111770
- Affected
- @modelcontextprotocol/server 2.0.0 through 2.2.0
- Fixed in
- 2.3.0
Last verified against sources: October 26, 2026
Am I affected?
@modelcontextprotocol/server (MCP TypeScript server SDK): affected @modelcontextprotocol/server 2.0.0 through 2.2.0. Fixed in 2.3.0.
- Check your version: run
npm ls @modelcontextprotocol/server. Versions >= 2.0.0, < 2.3.0 of @modelcontextprotocol/server are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install @modelcontextprotocol/server@2.3.0(first patched version 2.3.0). [1] - Upgrade to @modelcontextprotocol/server 2.3.0 or later. [1]
- Pass a factory to createMcpHandler() that builds a new McpServer on every call. [1]
- Or build a new McpServer and a new transport inside the request handler, once per request. [1]
- Or set sessionIdGenerator and keep one McpServer and one transport per session. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- An MCP server reached over HTTP could deliver one client's responses and notifications to another client. [1]
- This happened when clients shared one stateless transport, or one McpServer or Server instance. [1]
- Messages were matched to a connection by JSON-RPC id alone, and SDK clients number requests from 0, so ids collide in normal use. [1]
- You are affected if more than one client can reach your HTTP endpoint and your code creates the transport or the server once at startup instead of once per request or per session. [1]
Impact
- One client could receive another client's responses and notifications. [1]
What was done
- The fix is released in @modelcontextprotocol/server 2.3.0. [1]
- The SDK now refuses to be shared, so an affected app fails requests after upgrading: a second connect() rejects with ALREADY_CONNECTED, and a stateless transport rejects its second request. [1]
- Until this release, the README examples of @modelcontextprotocol/hono, express, fastify and node showed the affected pattern. [1]
Sources
- GHSA-jm63-cq47-j5jp — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-111770] MCP TypeScript server SDK sent one HTTP client's messages to another
Product: @modelcontextprotocol/server (MCP TypeScript server SDK) | Affected: @modelcontextprotocol/server 2.0.0 through 2.2.0 | Fixed in: 2.3.0
Summary: An MCP server reached over HTTP could deliver one client's responses and notifications to another client.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-111770-modelcontextprotocol-server-mcp-typescript-server-sdkCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-111770
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.