PT-2026-6315 · Unknown · Mcp Typescript Sdk

Ahabian + 1 · CVE-2026-25536 · Published 2026-02-04 · Updated 2026-04-22

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions MCP TypeScript SDK versions 1.10.0 through 1.25.3

Description The MCP TypeScript SDK, designed for Model Context Protocol servers and clients, exhibits a cross-client response data leak. This occurs when a single McpServer/Server and transport instance is reused across multiple client connections, particularly in stateless StreamableHTTPServerTransport deployments. The issue has been addressed in version 1.26.0.

Recommendations Update to version 1.26.0 or later.

Exploit

Fix

Race Condition

Time Of Check To Time Of Use

Weakness Enumeration

CWE-1395

CWE-362

CWE-367

Related Identifiers

CVE-2026-25536

GHSA-345P-7CG4-V4C7

GHSA-W2FM-25VW-VH7F

Affected Products

Mcp Typescript Sdk

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25536.json · Exploit
• https://github.com/modelcontextprotocol/typescript-sdk/issues/243 · Vendor Advisory
• https://github.com/modelcontextprotocol/typescript-sdk/issues/204 · Vendor Advisory
• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:3960 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-345p-7cg4-v4c7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25536 · Security Note
• https://osv.dev/vulnerability/GHSA-w2fm-25vw-vh7f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25536 · Vendor Advisory
• https://github.com/modelcontextprotocol/typescript-sdk · Note
• https://github.com/vercel/mcp-handler · Note
• https://github.com/vercel/mcp-handler/security/advisories/GHSA-w2fm-25vw-vh7f · Note
• https://twitter.com/InProd_eng/status/2039326919447945352 · Twitter Post
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25536.json · Note
• https://access.redhat.com/security/cve/CVE-2026-25536 · Note