Five flaws patched in the MCP TypeScript SDK

Maintainers of the Model Context Protocol (MCP) TypeScript SDK disclosed five vulnerabilities on 20 October 2026, affecting the npm packages that many AI agent tools use to talk to MCP servers. The advisories, published on GitHub, cover credential leakage, cross-client message mix-ups, token confusion between services, task data shared between sessions, and a denial-of-service bug that can kill a server with a single request. Fixed releases are @modelcontextprotocol/sdk 1.32.0 and the 2.x packages @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/client 2.3.0, @modelcontextprotocol/express 2.0.2 and @modelcontextprotocol/server-legacy 2.3.1.

The most sensitive issue for client applications is CVE-2026-111769. According to the advisory, the SDK's HTTP transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request elsewhere, that other origin received custom headers such as an X-API-Key, plus the mcp-session-id header. On a 307 or 308 redirect it also received the request body, which for OAuth token requests includes the refresh_token and client_secret. All versions of @modelcontextprotocol/sdk through 1.31.0 and @modelcontextprotocol/client 2.0.0 to 2.2.0 are affected; stdio clients are not. The maintainers say redirects are now limited to the same origin, and advise rotating API keys and client secrets and revoking tokens if a redirect may have reached a host you do not control.

CVE-2026-111770 affected @modelcontextprotocol/server 2.0.0 to 2.2.0. The advisory says a server reached over HTTP could deliver one client's responses and notifications to another client, because messages were matched to a connection by JSON-RPC request id alone and SDK clients all number their requests from zero. This happened when clients shared one stateless transport or one server instance, a pattern the README examples for the Hono, Express, Fastify and Node packages showed until this release. Upgrading is not enough: the SDK now refuses to be shared, so affected apps must build a new server per request, per session, or via a factory.

Two other fixes are also off by default. CVE-2026-111771 covers server bearer authentication that had no way to check a token's audience, so where one authorization server issues tokens for several services, a token meant for another service was accepted. The patched versions add an expectedResource setting that only works if verifyAccessToken() also returns the token's audience. CVE-2026-111768 describes servers placing no limit on how many array elements and object keys they validated, so one request inside the default 4 MiB size limit could exhaust memory and abort the process with a heap-out-of-memory error. No credentials are needed unless requests are authenticated before reaching the SDK. The fix adds a maxToolInputElements option that administrators must set themselves, alongside a tighter request body size limit.

The fifth issue, CVE-2026-111767, affects the experimental tasks feature in @modelcontextprotocol/sdk 1.24.0 to 1.31.0. Tasks were not tied to the session that created them, so clients sharing one in-memory task store could list, read and cancel each other's tasks. The maintainers note that experimental tasks are deprecated, that the 2026-07-28 specification replaced them, and that the best course of action is to stop using them.