High · published February 4, 2026
⚡ A single shared transport instance could spill the beans! In versions 1.10.0 to 1.25.3 of the MCP TypeScript SDK, reusing a McpServer/Server led to sneaky cross-client data leaks. 🔥 Think of it like a restaurant where multiple tables share the same waiter — if the waiter mixes up orders, sensitive information could be served to the wrong customers! An attacker could intercept and access confidential data from other clients, exposing sensitive information like user credentials or private data in the process. This could lead to devastating consequences for trust and privacy in your application.
Think of it like a restaurant where multiple tables share the same waiter — if the waiter mixes up orders, sensitive information could be served to the wrong customers! This vulnerability arises when a single McpServer/Server and transport instance are reused across multiple client connections, allowing data meant for one client to be accessed by others due to improper isolation.
An attacker could intercept and access confidential data from other clients, exposing sensitive information like user credentials or private data in the process. This could lead to devastating consequences for trust and privacy in your application. To patch this vulnerability, immediately update your MCP TypeScript SDK to version 1.26.0 or higher. Also, review your server design to ensure that unique server instances are used for different client connections to enhance isolation. 🛡️ You've got this! With the right updates, you'll shore up your defenses in no time! 🚀