On October 15, 2026, the Model Context Protocol TypeScript SDK maintainers published advisory GHSA-jm63-cq47-j5jp (CVE-2026-111770), rated High at CVSS 7.7: “Shared transport or server instances delivered one HTTP client’s messages to another.” When an MCP server reachable over HTTP shared one stateless transport, or one McpServer or Server instance, across clients, responses and notifications could be delivered to the wrong client. The SDK matched messages to a connection by JSON-RPC id alone, and because SDK clients start numbering requests at 0, ids collide in normal use. The weakness is classed as CWE-362, a race condition.
Affected is the npm package @modelcontextprotocol/server, versions 2.0.0 through 2.2.0, patched in 2.3.0. A server is exposed if multiple clients can reach its endpoint and its code creates the transport or server once at startup. Stdio servers, createMcpHandler() with a per-call factory, and @modelcontextprotocol/sdk 1.26.0 and later are not affected. The fix is breaking by design: the SDK now refuses to be shared, so applications that are not updated will fail requests, and the advisory tells developers to create a new server per call, per request, or one server and transport per session. The reporters credited are DavidCarliez and legitu1337.
It was one of six advisories the repository published in October 2026. Two others on the same day, both High, covered a single HTTP request within the default size limit exhausting server memory during validation, and HTTP server transports not limiting request body size or JSON-RPC batch length. Earlier in the month came advisories on experimental tasks not being tied to the session that created them, transports following cross-origin redirects while re-sending custom headers and bodies, and server bearer authentication accepting tokens issued for another service.
Why it matters: MCP is the plumbing many agents use to reach tools and data, and a cross-tenant leak in the reference SDK means one user’s tool results could surface in another user’s agent session. The “create once at startup” pattern it punishes is the natural way to write a server, and the same advisory database lists an earlier, similar issue from February 2026.
What it does not show: the advisory reports no exploitation in the wild and gives no count of affected deployments; whether data actually leaked depends on how each server was built and how many clients shared it.