Security: modelcontextprotocol/typescript-sdk
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Sharing server/transport instances can leak cross-client response dataGHSA-345p-7cg4-v4c7 published
Feb 4, 2026 by pcarletonHigh -
Regular Expression Denial of Service (ReDoS) in UriTemplateGHSA-cqwc-fm46-7fff published
Jan 7, 2026 by pcarletonHigh -
DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on LocalhostGHSA-w48q-cv73-mx4w published
Dec 2, 2025 by pcarletonHigh