@modelcontextprotocol/sdk vulnerabilities
CVEs whose affected-version data names the @modelcontextprotocol/sdk package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
GHSA-f897-62hf-6gxqHigh· 7.5MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
▾ Twilightmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA
CVE-2026-111771Medium· 6.8MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
▾ Sunlitmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA
CVE-2026-111768High· 7.5MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
▾ Twilightmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA
CVE-2026-111769Medium· 6.5MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
▾ Sunlitmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA