MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

影響: npm:@modelcontextprotocol/sdk >= 1.24.0, < 1.32.0 → 1.32.0

In affected versions, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them. Am I affected? Only if your HTTP server passes taskStore to McpServer or Server. If grep -ri taskstore --exclude-dir=node_modules . finds no…

GitHub Advisory Databaseで読む

2026/10/21 03:26、GitHub Advisory Databaseが「MCP TypeScript SDK: Experimental tasks were not tied to the session that created them」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-111767。