CVE-2026-25536

HighCVSS 7.1

Published: 04/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

A vulnerability in the MCP TypeScript SDK allows cross-client response data leak when a single server and transport instance is reused across multiple client connections. The issue affects versions 1.10.0 through 1.25.3, most notably in stateless StreamableHTTPServerTransport deployments.

Risk Assessment

The organization is at risk of unauthorized access to response data intended for other clients, potentially leading to leakage of sensitive information and communication integrity breaches.

Recommendation

Immediately update the MCP TypeScript SDK to version 1.26.0 or later, which contains the fix for this vulnerability.

Other vulnerabilities in MCP TypeScript SDK

CVE-2026-0621High
A ReDoS vulnerability in Anthropic's MCP TypeScript SDK up to version 1.25.1 exists in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression contains nested quantifiers that can cause catastrophic backtracking on specially crafted inputs, leading to excessive CPU consumption.

Original NVD description (English source)

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.