CVE-2026-25536High· 7.1▾ TwilightMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
mcp_typescript_sdk >= 1.10.0, < 1.26.0Upgrade past the affected range:
mcp_typescript_sdk 1.26.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-0621High· 7.5Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns
CVE-2026-43631High· 8.1llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary…
CVE-2026-58716Medium· 6.7In multiple locations, there is a possible time-of-check to time-of-use due to a race condition
CVE-2023-35823High· 7.0An issue was discovered in the Linux kernel before 6.3.2
CVE-2026-20677Critical· 9.0A race condition was addressed with improved handling of symbolic links
CVE-2026-20617High· 7.0A race condition was addressed with improved state handling