No. 093OSV · 1 source
MCP TypeScript server SDK: shared transport delivered one HTTP client's messages to another
The OSV advisory reports a HIGH-severity flaw in the MCP TypeScript server SDK where a shared transport or server instance could deliver one client's responses and notifications to another.
On this page
What's on the official record
The OSV advisory GHSA-jm63-cq47-j5jp reports a HIGH-severity vulnerability in the npm package @modelcontextprotocol/server, the MCP TypeScript server SDK, in the mcp layer. The advisory names no affected version range and names 2.3.0 as the fixed version. It carries alias CVE-2026-111770 and CWE-362, and is dated 20 October 2026.
In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one McpServer or Server instance. Messages were matched to a connection by JSON-RPC id alone.
Assessment
For a platform or AI-stack owner, the record lets you check the pinned version of @modelcontextprotocol/server in any MCP server you run, especially one reached over HTTP with a shared transport or a shared McpServer or Server instance. The advisory states the flaw could deliver one client's responses and notifications to another when that sharing is present, which is a data-isolation defect to isolate or patch. The record gives you a fixed version, 2.3.0, to rotate to or to pull the affected version until the update is applied.
For a deal team, the record lets you scope diligence on any target that ships or operates an MCP server built on the TypeScript SDK. The advisory states the flaw could deliver one client's responses and notifications to another when a transport or server instance is shared, which is a data-isolation defect to price into the target's stack. The record gives you a fixed version to condition on, and a reason to walk if the target cannot confirm the update.
What would change this call
A revised advisory that names an affected version range or a different fixed version would change the patch target. A statement that the flaw is reachable without a shared transport or shared server instance would widen the exposure.
What to check next
| Check | Why |
|---|---|
| Pinned version of @modelcontextprotocol/server in each MCP server | Confirm whether it is below the fixed version 2.3.0 |
| Whether any MCP server is reached over HTTP with a shared transport or shared McpServer/Server instance | The advisory ties the flaw to that sharing |
| Whether the advisory is revised to name an affected range | The current record names only the fixed version |
Confidence
Filed 25 October 2026 from the record dated 20 October 2026.
Sources
[1] MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another — https://github.com/advisories/GHSA-jm63-cq47-j5jp
- Entry
- 093
- Published
- Record
- OSV · 1 source
- Written for
AI assistants read this note with get_note cyb-20261020-ghsa-jm63-cq47-j5jp. Connect yours