CVE-2026-25536

Katalog CVE

CVSS 7.1 · High EPSS 0,38%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada lfprojects mcp typescript sdk. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/modelcontextprotocol/typescript-sdk/issues/204 issue tracking · advisory vendor
• https://github.com/modelcontextprotocol/typescript-sdk/issues/243 issue tracking · advisory vendor
• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7 mitigasi · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3960
• https://access.redhat.com/security/cve/CVE-2026-25536
• https://bugzilla.redhat.com/show_bug.cgi?id=2436937
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25536.json