MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From
    version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport
    instance is reused across multiple client connections, most commonly in stateless
    StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0. (CVE-2026-25536)

ID	Name	Product	Family	Type	Severity
457070	Echo: @modelcontextprotocol/sdk: security update to 1.26.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
457070	Echo: @modelcontextprotocol/sdk: security update to 1.26.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
437553	SCA: security update for @modelcontextprotocol/sdk (GHSA-345p-7cg4-v4c7)	Tenable Cloud Security	SCA Checks	Local	high
437553	SCA: security update for @modelcontextprotocol/sdk (GHSA-345p-7cg4-v4c7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-25536

high

Tenable Plugins

high

high

high

high