@modelcontextprotocol/client vulnerabilities

CVEs whose affected-version data names the @modelcontextprotocol/client package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111769Medium· 6.5

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

▾ Sunlitmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA

@modelcontextprotocol/client vulnerabilities (CVEs) · VulnSea