MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

影響: npm:@modelcontextprotocol/sdk >= 1.24.0, < 1.32.0 → 1.32.0

In affected versions, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them. Am I affected? Only if your HTTP server passes taskStore to McpServer or Server. If grep -ri taskstore --exclude-dir=node_modules . finds no…

在 GitHub Advisory Database 阅读

2026/10/21 03:26，GitHub Advisory Database 发布了“MCP TypeScript SDK: Experimental tasks were not tied to the session that created them”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-111767。