CVE-2026-111770: Shared MCP TypeScript servers mix client responses

Tracking: CVE-2026-111770
Severity: High

Who is affected

@modelcontextprotocol/server from 2.0.0 through 2.2.0, when unrelated HTTP clients share a stateless transport or server instance. The advisory excludes stdio and the protected 1.x SDK line from this finding.

How the attack works

Message routing relies on JSON-RPC request IDs without sufficient client separation. Ordinary reuse of IDs, such as 0, can cause one client's responses or notifications to reach another. Attackers need not guess a secret identifier to exploit normal ID collisions.

Upgrading adds connection guards, but an application that keeps reusing an instance may then fail with ALREADY_CONNECTED or reject later stateless requests.

What to do

1. Upgrade to 2.3.0 or later and review server and transport creation in the integration.
2. Create fresh instances per stateless request, or per session where the transport is session-based. Use the documented factory pattern, such as the createMcpHandler integration.
3. Check for cross-client responses and test repeated requests after the change. A successful package upgrade alone does not prove the application's lifetime handling is correct.

Scope and limits

The workaround and final implementation must separate unrelated clients, rather than only changing request ID values.

Sources

• Original advisory or incident report