CVEs / CVE-2026-25536
CVE-2026-25536
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
Affected products · 1
| Product | Versions affected | Fixed in |
|---|---|---|
| lfprojects: mcp typescript sdk | >= 1.10.0 < 1.26.0 | 1.26.0 |
Versions as NVD's CPE configuration states them; "—" means the record gives no fixed version, not that none exists. Check the vendor's advisory in the references.
In this registry
- python-sdk — agent dossier
- typescript-sdk — agent dossier
References · 7
- github.com/modelcontextprotocol/typescript-sdk/issues/204 — Issue Tracking, Vendor Advisory
- github.com/modelcontextprotocol/typescript-sdk/issues/243 — Issue Tracking, Vendor Advisory
- github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7 — Mitigation, Vendor Advisory
- access.redhat.com/errata/RHSA-2026:3960
- access.redhat.com/security/cve/CVE-2026-25536
- bugzilla.redhat.com/show_bug.cgi?id=2436937
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25536.json
The official record's references, as NVD lists them, minus any tagged Exploit. Nothing here is an exploit or a proof of concept.
Description, scores, versions and references are the official CVE record's own, retrieved 2026-10-25 from NVD. Category, attack surface and cross-links are this registry's classification and can be wrong — use the button above. Not a severity assessment for your deployment.