Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-f897-62hf-6gxq
  • npm/@modelcontextprotocol/hono
  • npm/@modelcontextprotocol/node
  • npm/@modelcontextprotocol/sdk
  • npm/@modelcontextprotocol/server
 MCP TypeScript SDK: HTTP server transports and handlers did not limit request... 27 Oct
  • Fix available
  • Severity - 7.5 (High)
GHSA-46jr-4wx8-v453
  • npm/@modelcontextprotocol/sdk
  • npm/@modelcontextprotocol/server
 MCP TypeScript SDK: One HTTP request within the default size limit could... 20 Oct
  • Fix available
  • Severity - 7.5 (High)
GHSA-rvq5-wwqv-78pq
  • npm/@modelcontextprotocol/express
  • npm/@modelcontextprotocol/sdk
  • npm/@modelcontextprotocol/server
  • npm/@modelcontextprotocol/server-legacy
 MCP TypeScript SDK: Server bearer authentication accepted tokens issued for... 20 Oct
  • Fix available
  • Severity - 6.8 (Medium)
GHSA-22jm-h49p-29qw
  • npm/@modelcontextprotocol/sdk
 MCP TypeScript SDK: Experimental tasks were not tied to the session that... 20 Oct
  • Fix available
  • Severity - 8.6 (High)
GHSA-6prh-2h8m-c8cw
  • npm/@modelcontextprotocol/client
  • npm/@modelcontextprotocol/sdk
 MCP TypeScript client SDK: HTTP client transports and OAuth requests followed... 20 Oct
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-6qxp-vccf-f47h
  • npm/@modelcontextprotocol/client
  • npm/@modelcontextprotocol/sdk
 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server 06 Oct
  • Fix available
  • Severity - 7.5 (High)
GHSA-345p-7cg4-v4c7
  • npm/@modelcontextprotocol/sdk
 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse 04 Feb
  • Fix available
  • Severity - 7.1 (High)
GHSA-8r9q-7v3j-jr4g
  • npm/@modelcontextprotocol/sdk
 Anthropic's MCP TypeScript SDK has a ReDoS vulnerability 05 Jan
  • Fix available
  • Severity - 8.7 (High)
GHSA-w48q-cv73-mx4w
  • npm/@modelcontextprotocol/sdk
 Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default 02 Dec 2025
  • Fix available
  • Severity - 7.6 (High)