@modelcontextprotocol/sdk
npm8 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @modelcontextprotocol/sdkpage 1 of 1
- CVE-2025-66414HIGHCVSS 8.1EG 8.1fixed in 1.24.02025-12-02
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. …
- CVE-2026-0621HIGHCVSS 7.5EG 7.5fixed in 1.25.22026-01-05
Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated re…
- CVE-2026-104850HIGHCVSS 7.5EG 7.5fixed in 1.31.02026-10-06
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to de…
- CVE-2026-111767HIGHCVSS 8.6EG 8.6fixed in 1.32.02026-10-20
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients …
- CVE-2026-111768HIGHCVSS 7.5EG 7.5fixed in 1.32.02026-10-20
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server,…
- CVE-2026-111769MEDIUMCVSS 6.5EG 6.5fixed in 1.32.02026-10-20
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTT…
- CVE-2026-111771MEDIUMCVSS 6.8EG 6.8fixed in 1.32.02026-10-20
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, fr…
- CVE-2026-25536HIGHCVSS 7.1EG 7.1fixed in 1.26.02026-02-04
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multipl…
Check whether @modelcontextprotocol/sdk is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @modelcontextprotocol/sdk CVEs against the assets you own.
Book a Demo →