Vulnerability Overview
The Model Context Protocol TypeScript SDK contained a high-severity vulnerability tracked as **CVE-2026-111770** that caused MCP servers reached over HTTP to deliver responses and notifications intended for one client to a different client. The flaw affected versions 2.0.0 through 2.2.0 of the `@modelcontextprotocol/server` package.
According to the GitHub Security Advisory GHSA-jm63-cq47-j5jp, the issue occurred when applications shared one stateless HTTP transport or one `McpServer` or `Server` instance among multiple clients. Messages were associated with connections using only the JSON-RPC request identifier, and because SDK clients start request identifiers at zero, collisions occurred during normal operation.
Technical Details
The vulnerability manifested when:
- Multiple clients could reach an HTTP endpoint
- The transport or server was created once at startup instead of per request or per session
- JSON-RPC request IDs collided between different clients
The advisory states that “SDK clients number requests from 0, so ids collide in normal use.” This design flaw meant that responses intended for one client could be routed to another client with a matching request ID.
Until the patched release, the README examples of `@modelcontextprotocol/hono`, `@modelcontextprotocol/express`, `@modelcontextprotocol/fastify`, and `@modelcontextprotocol/node` demonstrated the vulnerable pattern of creating transport or server instances once at startup.
Affected Versions and Components
The vulnerability affected:
- `@modelcontextprotocol/server` versions 2.0.0, 2.1.0, and 2.2.0
- MCP servers reached over HTTP by multiple clients
- Applications reusing one stateless transport or server instance
Not affected:
- `createMcpHandler()` with a factory building new servers per call
- stdio servers
- `@modelcontextprotocol/sdk` version 1.26.0 and later
Patch and Mitigation
Version 2.3.0, released on October 2, 2026, addresses the vulnerability through pull request #2918 (commit 84804c2). The fix implements strict connection management:
- A `Server` or `McpServer` now serves one connection at a time
- Stateless HTTP transports (`sessionIdGenerator: undefined`) serve one request only
- `connect()` rejects with `SdkErrorCode.ALREADY_CONNECTED` on reuse attempts
- `WebStandardStreamableHTTPServerTransport.handleRequest()` rejects second requests with the message “Stateless transport cannot be reused across requests. Create a new transport per request.”
- `NodeStreamableHTTPServerTransport.handleRequest()` returns HTTP 500 on reuse
Required Code Changes
Upgrading to version 2.3.0 requires application code changes. The SDK now refuses to be shared, causing affected applications to fail after upgrade. Developers must adopt one of these patterns:
**Option 1 – createMcpHandler():** Pass a factory function that builds a new `McpServer` on every call:
“`
createMcpHandler(buildServer)
“`
**Option 2 – Per request:** Build a new `McpServer` and transport inside each request handler, moving `new McpServer(…)` and registrations into the handler.
**Option 3 – Per session:** Set `sessionIdGenerator` and maintain one `McpServer` and one transport per session.
According to the changeset, applications using one server object with a new stateless transport per request will see the second HTTP request fail with `ALREADY_CONNECTED`. Applications reusing one stateless transport will see `handleRequest()` reject on the second request.
The advisory notes that what the caller sees when `connect()` or `handleRequest()` rejects depends on the host: Express 5, Fastify, and Hono answer with HTTP 500, while a plain `node:http` listener without error handling gets an unhandled rejection that ends the process.
Severity Assessment
NVD assigned this vulnerability a CVSS v3.1 score of **7.7 (High)** with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H.
The breakdown indicates:
- **Attack Vector: Network** – remotely exploitable
- **Attack Complexity: High** – requires specific conditions
- **Privileges Required: None** – no authentication needed
- **User Interaction: None** – automatic exploitation
- **Confidentiality Impact: High** – significant information disclosure
- **Integrity Impact: Low** – limited data modification
- **Availability Impact: High** – potential service disruption
The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization).
Additional Context
The fix was released alongside version 1.32.0 of the 1.x line, which had included similar connection checks since version 1.26.0. The 2.x branch required the same protections to prevent cross-client message delivery.
The GitHub advisory credits reporters DavidCarliez and legitu1337 for identifying the vulnerability. The maintainers updated all README examples and JSDoc handler examples in the affected packages to demonstrate the correct per-request pattern.
Release notes indicate the change is classified as a minor version bump for `@modelcontextprotocol/server` and patch releases for `@modelcontextprotocol/express`, `@modelcontextprotocol/fastify`, `@modelcontextprotocol/hono`, and `@modelcontextprotocol/node` to publish corrected documentation.
