Is CVE-2026-111770 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111770 being exploited in the wild.

How severe is CVE-2026-111770?

High severity, with a CVSS score of 7.7, published 5 November 2026.

Which products and versions are affected?

Model Context Protocol @Modelcontextprotocol/Server 2.0.0 through 2.2.0; @modelcontextprotocol/server (npm) >= 2.0.0, < 2.3.0, SEMVER:introduced=2.0.0,fixed=2.3.0.

How is CVE-2026-111770 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111770?

Check whether you run Model Context Protocol @Modelcontextprotocol/Server or @modelcontextprotocol/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111770: MCP TypeScript server SDK cross-client message delivery in shared HTTP transport

Q: Is there a fix for CVE-2026-111770?

Yes. @modelcontextprotocol/server (npm): upgrade to 2.3.0 or later. Until then: In addition to upgrading, refactor your application: either pass a factory function to createMcpHandler() that builds a new McpServer on every call, create a new McpServer and transport inside each request handler, or implement per-session isolation using sessionIdGenerator with dedicated server and transport instances per session. [{"kind": "disclosed", "at": "2026-10-20"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-111770 · Severity: high · CVSS 7.7 · Published 2026-11-05

The MCP TypeScript server SDK is a toolkit for building AI-powered server applications that communicate over HTTP. When multiple clients connect to the same HTTP endpoint using a shared server instance, responses and notifications meant for one client can be delivered to another due to message matching on JSON-RPC ID alone. An attacker with network access could capture sensitive information intended for other clients or inject malicious responses.

Technologies: @modelcontextprotocol/server (npm). Vendors: Model Context Protocol, npm.

Quick answers

Is CVE-2026-111770 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111770 being exploited in the wild.
How severe is CVE-2026-111770?: High severity, with a CVSS score of 7.7, published 5 November 2026.
Which products and versions are affected?: Model Context Protocol @Modelcontextprotocol/Server 2.0.0 through 2.2.0; @modelcontextprotocol/server (npm) >= 2.0.0, < 2.3.0, SEMVER:introduced=2.0.0,fixed=2.3.0.
Is there a fix for CVE-2026-111770?: Yes. @modelcontextprotocol/server (npm): upgrade to 2.3.0 or later. Until then: In addition to upgrading, refactor your application: either pass a factory function to createMcpHandler() that builds a new McpServer on every call, create a new McpServer and transport inside each request handler, or implement per-session isolation using sessionIdGenerator with dedicated server and transport instances per session.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-20"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111770 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111770?: Check whether you run Model Context Protocol @Modelcontextprotocol/Server or @modelcontextprotocol/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@modelcontextprotocol/server (npm): upgrade to 2.3.0 or later
```
npm install @modelcontextprotocol/server@2.3.0
```

In addition to upgrading, refactor your application: either pass a factory function to createMcpHandler() that builds a new McpServer on every call, create a new McpServer and transport inside each request handler, or implement per-session isolation using sessionIdGenerator with dedicated server and transport instances per session.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-20"}]

Technical details

The vulnerability exists in @modelcontextprotocol/server versions 2.0.0–2.2.0, where messages are routed to clients using only the JSON-RPC request ID as the matching criterion. Since clients initialize request numbering from 0, IDs collide predictably when a stateless transport or single server instance is shared across multiple HTTP clients. An attacker with network access to an affected HTTP endpoint can receive messages intended for other clients or cause those clients to receive attacker-controlled responses. The fix requires both upgrading to version 2.3.0+ and refactoring the application to instantiate a new McpServer and transport per request or session rather than once at startup.

Affected products

Model Context Protocol @modelcontextprotocol/server 2.0.0 through 2.2.0

Identifiers

CVE-2026-111770
GHSA-jm63-cq47-j5jp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.