HIGH7.1npm
GHSA-345p-7cg4-v4c7· CVE-2026-25536@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Modified: 9/10/2026
package
npm/@modelcontextprotocol/sdk
pkg:npm/%40modelcontextprotocol/sdk
HIGHnpm
GHSA-8r9q-7v3j-jr4g· CVE-2026-0621Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Modified: 9/10/2026
HIGHnpm
GHSA-w48q-cv73-mx4w· CVE-2025-66414Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Modified: 9/10/2026