Is CVE-2026-25536 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25536 being exploited in the wild.

How severe is CVE-2026-25536?

High severity, with a CVSS score of 7.1, published 4 February 2026.

Which products and versions are affected?

Anthropic Model Context Protocol >=1.10.0, = 1.10.0, < 1.26.0; @modelcontextprotocol/sdk (npm) SEMVER:introduced=1.10.0,fixed=1.26.0.

Is there a fix for CVE-2026-25536?

Yes. @modelcontextprotocol/sdk (npm): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25536 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25536?

Check whether you run Anthropic Model Context Protocol, Lfprojects Mcp Typescript Sdk, Model Context Protocol TypeScript SDK or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25536: Model Context Protocol TypeScript SDK data leak in McpServer transport

Q: Is there a fix for CVE-2026-25536?

Yes. @modelcontextprotocol/sdk (npm): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-25536 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-25536?

Check whether you run Anthropic Model Context Protocol, Lfprojects Mcp Typescript Sdk, Model Context Protocol TypeScript SDK or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25536 · Severity: high · CVSS 7.1 · Published 2026-02-04

The Model Context Protocol SDK contains a design flaw that allows responses and sensitive data from one client to leak to another client when the server improperly reuses connection objects across multiple simultaneous client connections. This is particularly problematic in stateless cloud deployments where the same server instance handles many clients. An attacker with multiple concurrent connections to the server could intercept another client's tool responses, resource data, prompts, or progress notifications intended for a different user.

Technologies: Anthropic Model Context Protocol, Lfprojects Mcp Typescript Sdk, @modelcontextprotocol/sdk (npm). Vendors: Anthropic, Lfprojects, Model Context Protocol, npm.

Quick answers

Is CVE-2026-25536 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25536 being exploited in the wild.
How severe is CVE-2026-25536?: High severity, with a CVSS score of 7.1, published 4 February 2026.
Which products and versions are affected?: Anthropic Model Context Protocol >=1.10.0, <=1.25.3; Model Context Protocol TypeScript SDK >= 1.10.0, < 1.26.0; @modelcontextprotocol/sdk (npm) SEMVER:introduced=1.10.0,fixed=1.26.0.
Is there a fix for CVE-2026-25536?: Yes. @modelcontextprotocol/sdk (npm): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25536 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25536?: Check whether you run Anthropic Model Context Protocol, Lfprojects Mcp Typescript Sdk, Model Context Protocol TypeScript SDK or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@modelcontextprotocol/sdk (npm): upgrade to 1.26.0 or later
```
npm install @modelcontextprotocol/sdk@1.26.0
```

Technical details

The vulnerability consists of two related issues: (1) Reusing a single StreamableHTTPServerTransport across multiple client requests causes JSON-RPC message ID collisions to route responses to the wrong HTTP stream, since the SDK's default client uses an incrementing counter starting at 0. (2) Reusing a single McpServer/Server instance across multiple transports causes the Protocol's internal _transport reference to be silently overwritten, routing final responses, progress notifications, and server-initiated requests to whichever client's transport was most recently connected. Both issues are most common in stateless mode without per-request or per-session server/transport instantiation. The vulnerability requires concurrent clients or in-flight requests; single-client environments are unaffected. The fix (v1.26.0) adds runtime guards to Protocol.connect() and StreamableHTTPServerTransport.handleRequest() that throw errors instead of silently misrouting data, forcing developers to use separate instances per connection.

Affected products

Model Context Protocol @modelcontextprotocol/sdk >=1.10.0, <=1.25.3

Identifiers

CVE-2026-25536
GHSA-345p-7cg4-v4c7

Timeline

2026-02-04: disclosed
2026-02-04: patched: Fix released in version 1.26.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.