Cloudanix VulnDB

CVE-2026-25536

High · 7.1

CVSS

7.1

EPSS

0.4%

Published

Feb 4, 2026

CISA due date

—

The record

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.

Affected packages

Ecosystem Package Introduced Fixed
npm @modelcontextprotocol/sdk 1.10.0 1.26.0
Chainguard kibana-9.1 0 9.1.10-r4
Chainguard kibana-9.1-iamguarded 0 9.1.10-r4
Chainguard kibana-9.2 0 9.2.5-r0
Chainguard kibana-9.2-iamguarded 0 9.2.5-r0
Chainguard langfuse-3 0 3.153.0-r0
Chainguard langfuse-3-worker 0 3.153.0-r0
Chainguard langfuse-fips-3 0 3.152.0-r0
Chainguard langfuse-fips-3-worker 0 3.152.0-r0
Chainguard librechat 0 0.8.2-r2
Chainguard opensearch-dashboards-2 0 2.19.4-r8
Chainguard opensearch-dashboards-2-fips 0 2.19.4-r9
Wolfi langfuse-3 0 3.153.0-r0
Wolfi langfuse-3-worker 0 3.153.0-r0
Wolfi opensearch-dashboards-2 0 2.19.4-r8

Related vulnerabilities