@modelcontextprotocol/server vulnerabilities
CVEs whose affected-version data names the @modelcontextprotocol/server package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-111771Medium· 6.8MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
▾ Sunlitmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA
CVE-2026-111770High· 7.7MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
▾ Twilightmodelcontextprotocol · @modelcontextprotocol/servervia GHSA
CVE-2026-111768High· 7.5MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
▾ Twilightmodelcontextprotocol · @modelcontextprotocol/sdkvia GHSA