MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another

影響: npm:@modelcontextprotocol/server >= 2.0.0, < 2.3.0 → 2.3.0

In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one McpServer or Server instance. Messages were matched to a connection by JSON-RPC id alone. SDK clients number requests from 0, so ids collide in normal use. Am I affected? Yes, if more than one client can reach your HTTP endpoint and your code creates the transport or the server once at startup, i…

GitHub Advisory Databaseで読む

2026/10/21 05:07、GitHub Advisory Databaseが「MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-111770。