MCP TypeScript SDK: a shared server delivered one client's responses to another (CVE-2026-111770)
In one sentence On October 20 advisories were published for the Model Context Protocol TypeScript SDK: CVE-2026-111770 (CVSS 7.7) delivers one HTTP client's responses and notifications to another, CVE-2026-111771 (CVSS 6.8) accepts bearer tokens issued for another service. Fixed in 2.3.0 and 2.3.1.
MCP is the protocol AI assistants use to connect to external tools: databases, files, business services. Many MCP servers are written with the official TypeScript SDK. On October 20 two security advisories were published for this SDK.
The first is the trickiest: if several clients used the same server over HTTP, responses meant for one could reach another. The reason is simple: the server matched replies only by request number, and every client starts counting from zero, so the numbers overlapped in normal use. In practice one user could see data requested by someone else.
The second concerns authentication: the server accepted valid tokens that had been issued for a different service, when the same login system served several applications. Both issues are closed by updating the package, but the first also requires changing how the server is created.
Companies
Model Context Protocol
Tools
MCP TypeScript SDK, @modelcontextprotocol/server
Tags
Sources