CVE-2026-111770

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/server versions 2.0.0 through 2.2.0

Description An MCP server accessed over HTTP may deliver responses and notifications from one client to another. This occurs when clients share a single stateless transport, McpServer instance, or Server instance. The issue stems from messages being matched to a connection using only the JSON-RPC id. Since SDK clients typically start numbering requests from 0, these identifiers collide during normal operation.

Recommendations Upgrade to @modelcontextprotocol/server version 2.3.0 or later. As a necessary code change, implement one of the following: pass a factory to createMcpHandler() that builds a new McpServer on every call, build a new McpServer and transport inside the request handler for each request, or set sessionIdGenerator to maintain one McpServer and transport per session.