CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Cross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments.
What it is
Cross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments.
This advisory covers two related but distinct vulnerabilities. A deployment may be affected by one or both.
What happens: When a single StreamableHTTPServerTransport instance handles multiple client requests, JSON-RPC message ID collisions cause responses to be routed to the wrong client's HTTP connection. The transport maintains an internal requestId → stream mapping, and since MCP client SDKs generate message IDs using an incrementing counter starting at 0, two clients produce identical IDs. The second client's request overwrites the first client's mapping entry, routing the response to the wrong HTTP stream.
How to check
- Affected: @modelcontextprotocol/sdk (npm) >= 1.10.0, <= 1.25.3.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade @modelcontextprotocol/sdk to 1.26.0 or later.
npm ls @modelcontextprotocol/sdkSources
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalCVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx
- criticalLangflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)
- criticalCVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability