MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another (CVE-2026-111770)

In affected versions of @modelcontextprotocol/server (2.0.0 through 2.2.0), an MCP server reachable via HTTP could mistakenly deliver responses and notifications intended for one client to another client if multiple clients share a stateless transport or a single McpServer or Server instance. This is due to message matching relying solely on JSON-RPC id, which SDK clients number from zero, causing id collisions under normal use. The vulnerability does not affect stdio servers or SDK versions 1.26.0 and later. The issue is resolved in version 2.3.0 and later, which also introduces SDK behavior changes that prevent sharing client connections. Correct usage now requires creating a new McpServer and transport per request or session, or using a factory to build a new server on each call.

An attacker or client could receive responses or notifications intended for another client, potentially exposing sensitive data or causing confusion in client-server communication. The CVSS score is 7.7 (high), reflecting network attack vector, high impact on confidentiality and availability, and low complexity but requiring high attack complexity due to the need to share the same server or transport instance.

A fix is available in @modelcontextprotocol/server version 2.3.0 and later. Users must upgrade to this version and modify their code to avoid sharing SDK clients or server instances across multiple clients. Specifically, use createMcpHandler() with a factory that builds a new McpServer on every call, build a new McpServer and transport per request, or maintain one McpServer and transport per session with sessionIdGenerator configured. If upgrading is not immediately possible, applying these code changes to avoid shared instances also mitigates the issue.